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Abstract 

The  production  and  exchange  of  information  has  become  a  central  activity  in  today’s 
global  economy.  Protecting  and  securing  information  as  it  travels  over  the  vast,  mostly  public 
Internet  has  emerged  as  perhaps  the  premiere  issue  of  the  Information  Age.  Thus,  the  attack  and 
defense  of  electronic  information  has  formed  an  entirely  new  kind  of  conflict  -  information 
warfare. 

Information  warfare  is  still  in  its  infancy.  Government  and  private  organizations  alike 
poorly  understand  this  ubiquitous  form  of  confrontation.  Nevertheless,  they  cannot  avoid 
devoting  ever  increasing  portions  of  their  budgets  to  information  warfare.  Both  obtaining  other  s 
information  and  defending  one’s  own  information  have  become  critical  economic  decisions.  As 
with  any  economic  decision,  the  benefits  (i.e.  utility)  must  be  commensurate  with  the  resources 
expended  to  acquire  those  benefits. 

Game  theory  could  provide  a  new  method  for  analyzing  information  warfare.  The 
strategic  and  tactical  decisions  that  face  information  warriors  are  essentially  economic  in  nature. 
Does  the  value  of  the  information  being  defended  or  sought  justify  the  cost  of  protecting  or 
seeking  it?  Game  theory  could  contribute  to  a  better  understanding  of  information  warfare 
strategy  and  implications. 

The  application  of  game  theory  to  information  warfare  is  a  complex  and  massive 
undertaking.  This  study  is  but  the  first  step  in  exploring  the  full  ramifications  of  this  potential 
application  of  game  theory. 
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TOWARDS  A  GAME  THEORY  MODEL  OF  INFORMATION  WARFARE 


1.  Introduction 

Information  warfare  (IW)  is  a  complex  problem  of  competitive  negotiations  between 
parties  who  have  incomplete  information  regarding  each  other’s  intentions  and  capabilities.  IW 
can  be  characterized  as  inter-related  and  repeated  discrete  engagements  among  participants  who 
are  rational  and  goal  oriented  (Libicki,  1997:  40).  IW  participants  often  engage  in  a  particular 
strategy,  assess  their  outcomes,  refine  their  strategy  based  on  these  outcomes,  and  then  reengage 
with  their  refined  strategy.  This  process  is  far  more  rational  than  the  common  and  incorrect  view 
of  IW  as  the  venue  of  joyriding  teenage  hackers  (Kovacich,  1997:  56). 

Although  seemingly  random  IW  attacks  occur  on  a  regular  basis,  formalized  IW  among 
participants  with  specific  goals  is  now  increasingly  relevant.  IW  is  becoming  an  important  part 
of  corporate  and  military  strategy.  Corporations  and  militaries  include  IW  as  a  formal  way  of 
obtaining  their  goals.  IW  strategies  are  also  highly  interrelated.  Specifically,  IW  participants 
develop  strategies  to  combat  specific  strategies  of  their  opponent.  Participants  must  determine  if 
an  unsuccessful  strategy  failed  of  its  own  accord  or  due  to  the  actions  of  their  opponent 
(Kovacich,  1997:  56). 

1.1  Application  of  Game  Theory  to  IW 

Game  theory  has  shed  light  on  similar  problems  in  economics  and  other  social  sciences. 
Game  theoretic  analysis  of  nuclear  disarmament  negotiations  provides  a  particularly  relevant 
foundation  for  the  development  of  a  game  theory  model  of  information  warfare.  Nuclear 
disarmament  negotiations  centers  on  the  role  of  information,  much  as  information  warfare  does. 
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Similar  concerns  of  when  information  should  be  revealed  and  protected  and  how  information 
should  be  protected,  exist  in  nuclear  disarmament  negotiations  and  IW  situations  (Aumann  and 
Maschler,  1995:xiv-xvi). 

Game  theory  provides  a  means  to  represent  complex,  competitive  situations  into 
mathematical  models  that  allow  a  more  rigorous  study  of  the  situation  at  hand.  This  study 
involves  one  class  of  games  that  grew  out  of  game  theoretic  research  into  nuclear  disarmament 
negotiations,  specifically,  repeated  games  of  incomplete  information.  The  primary  motivation  is 
that  this  class  of  games  captures  many  of  the  elements  described  above  as  well  as  the  self-evident 
point  that  IW  participants  generally  will  not  directly  know  the  actions  or  specific  characteristics 
of  their  opponent. 

Although  the  nuclear  disarmament  negotiations  studies  provide  the  theoretical  basis  for 
this  study’s  proposed  IW  game  model,  significant  differences  exist  between  those  studies  and  the 
model  for  IW.  First,  the  most  rigorous  analysis  in  the  disarmament  studies  involves  incomplete 
information  on  the  part  of  only  one  of  the  parties;  this  study’s  information  warfare  model 
involves  incomplete  information  on  all  sides.  Second,  the  parties'  strategies  in  disarmament 
strategies  are  guaranteed  to  succeed  once  employed;  again,  the  information  warfare  model  must 
account  for  the  uncertainty  of  strategy  success.  Finally  and  most  importantly,  the  general  class 
of  games  used  to  model  disarmament  negotiations  has  not  been  the  subject  of  substantial 
empirical  study,  which  is  the  primary  purpose  of  this  study.  These  significant  differences 
prevent  direct  application  of  the  repeated  games  of  incomplete  information  model  to  information 
warfare  without  first  testing  its  applicability. 
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1.2  Research  Objectives 


One  of  the  basic  goals  of  game  theory  is  to  better  understand  behavior  in  particular  social 
situations.  In  particular,  game  theory  can  provide  a  means  to  determine  and  specify  elements 
influencing  decisions  and  to  make  behavioral  predictions.  Before  being  applied  in  this  manner, 
the  model  must  be  tested  in  a  simplified,  controlled  situation.  Since  the  game  model  of  this 
study  is  a  significant  modification  of  existing  models,  it  must  undergo  empirical  testing  before  it 
can  be  applied  to  actual  IW  situations.  This  study  will  use  an  experiment  to  address  the 
following  research  questions,  to  be  further  defined  later  in  this  report: 

Research  question  1 :  Does  the  information  warfare  game  model  developed  in  this  study 
provide  accurate  predictions  of  actual  information  warfare  behavior?  Game  theory  models  can 
predict  the  best  strategies  to  play  (i.e.  those  that  yield  the  highest  payoff).  If  the  information 
warfare  model  developed  herein  can  predict  actual  game  play,  then  its  possible  that  it  can  serve 
in  broader  studies  of  information  warfare. 

Research  question  2:  Does  the  information  warfare  game  model  support  analysis  of 
information  warfare  experience  and  learning?  Information  warfare  experience  should  improve 
performance  in  information  warfare  engagements.  So,  people  participating  in  this  study  s 
information  warfare  game  model  should  play  better  if  they  are  more  experienced.  Similarly, 
learning  more  about  information  warfare  strategy  should  also  improve  performance.  This  study 
will  use  the  information  warfare  game  model  to  evaluate  the  impact  of  learning  on  information 
warfare  performance. 

These  two  questions  will  help  determine  if  this  study’s  proposed  model  could  potentially 
be  applied  to  actual  information  warfare. 
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1.3  Applicability  of  Research 

Repeated  games  of  incomplete  information  could  potentially  apply  to  many  social 
situations.  However,  this  class  of  games  has  not  been  the  subject  of  significant  empirical  study. 
Experimental  research  could  show  the  accuracy  of  these  models  and  show  where  refinements 
need  to  be  made  in  these  models.  Information  warfare  provides  a  specific  situation  to  create  an 
empirically  testable  game  model.  In  particular,  IW  provides  the  means  to  structure  payoffs, 
probabilities  and  strategies  in  a  realistic  fashion,  rather  than  developing  a  game  model  based  on 
conjecture. 

Although  this  study  is  game  theory  oriented  and  concentrates  on  the  game  model  itself, 
the  eventual  goal  of  this  line  of  research  is  to  better  understand  information  warfare.  The  game 
model,  after  being  validated,  could  predict  behavior  and  provide  the  means  to  study  why  people 
act  as  they  do  in  IW  situations.  Additionally,  a  refined  game  model  could  form  the  basis  of  an 
IW  simulation  system.  This  system  could  be  employed  by  organizations  to  guide  their  IW 
strategy  choices.  However,  these  possibilities  are  several  studies  beyond  the  present  one. 

1.4  Sequence  of  Presentation 

Chapter  II  presents  an  overview  of  relevant  literature  regarding  information  warfare  and 
game  theory.  Particular  emphasis  is  placed  on  specific  information  attack  and  defense  strategies 
and  human  behavior  in  information  warfare.  The  discussion  of  game  theory  proceeds  from  a 
general  overview  to  a  detailed  development  of  those  aspects  of  game  theory  cogent  to  the 
proposed  game  model.  Chapter  III  describes  the  methodology  of  research.  Chapter  IV  presents 
the  results  of  the  experiments.  Chapter  V  provides  concluding  remarks  and  indicates  areas  for 
further  research. 
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2.  Literature  Review 

Initial  studies  of  games  appeared  in  economics  literature  as  early  as  1838  when  Cournot 
and  others  developed  models  of  oligopoly  pricing  and  production  (Gibbons,  1992:  iii).  These 
early  models  restricted  players  to  strategies  that  only  involved  quantity  or  price  decisions.  John 
Von  Neumann  and  Oskar  Morgenstem  developed  a  general  theory  of  games  in  1944  that  allowed 
the  development  and  analysis  of  more  complex  plans  and  strategies  (Von  Neumann  and 
Morgenstem,  1944:  10).  In  the  decades  since,  research  has  broadened  game  theory’s  scope  to 
include  industrial  organization,  labor  relations,  military  strategy,  nuclear  disarmament 
negotiations  and  other  social  sciences  (Fudenberg  and  Tirole,  1 99 1  :xviii). 

What  game  theory  brings  to  these  various  fields  is  the  capability  to  formally  model  and 
analyze  complex  social  situations.  Developing  a  mathematical  model  that  represents  selected 
aspects  of  a  complex  social  situation  can  allow  one  to  better  understand  some  of  the  elements 
influencing  that  situation.  Additionally,  if  the  underlying  game  model  is  sufficiently  robust,  it 
can  form  the  basis  for  decision  support  tools,  policy  development  guidelines,  or  behavioral 
analysis.  Most  social  situations  are  far  too  complex  for  exact  mathematical  analysis  thus  game 
theory  models  cannot  provide  specific  recommendations  for  specific  situations.  Nonetheless, 
game  theory  can  provide  general  insights  and  predictions  (Aumann  and  Maschler,  1995:  1-2). 

This  study  is  the  first  step  towards  applying  game  theory  to  the  study  of  information 
warfare  (IW),  particularly  as  it  concerns  the  United  States  military.  Technical  advances  and 
increasing  global  connectivity  in  the  last  few  years  have  brought  IW  to  the  forefront  of  national 
military  strategy.  The  application  of  game  theory  to  military  problems  began 
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contemporaneously  with  game  theoretic  research  itself.  Military  problems  such  as  information 
warfare  involve  many  of  the  same  concerns  as  game  theory.  Players’  outcomes  depend  on  their 
opponents’  decisions,  yet  they  do  not  know  what  their  opponents’  strategies  are  when  making 
decisions.  Thus  each  player  must  evaluate  their  opponent’s  capabilities,  keeping  in  mind  that 
their  opponent  is  performing  similar  evaluations.  In  military  conflicts  (such  as  information 
warfare)  the  participants  have  opposing  strategies,  thus  an  attacker  attempts  to  maximize  gains 
while  the  defender  attempts  to  minimize  their  losses.  Game  theory  attempts  to  model  and 
analyze  these  same  concerns  (Dresher,  1961:  1-2). 

This  chapter  will  first  discuss  how  the  motivation  for  and  the  methodology  of  developing 
the  information  warfare  game  model.  The  basic  elements  of  game  theory  models,  players, 
payoffs  and  information,  will  be  presented  as  the  foundation  for  the  IW  game  model.  Then,  two 
methods  for  representing  these  elements  will  be  described.  Next,  the  IW  game  model  will  be 
developed  based  upon  the  basic  game  theory  elements  and  representations.  Then,  this  chapter 
will  describe  current  research  that  provides  the  foundation  of  this  study’s  methodology.  Finally, 
this  study’s  research  questions  and  hypotheses  will  be  presented. 

2.1  Information  Warfare  Game  Model  Development 

The  conduct  of  information  warfare  provided  the  key  motivation  in  developing  the  model 
for  this  study.  Information  warfare  can  be  carried  out  in  many  different  ways.  Multinational 
corporations,  militaries  and  terrorists  have  surpassed  the  lone  teenage  hacker  breaking  into 
computer  systems  for  fun.  Information  warfare  is  becoming  a  formal  part  of  both  national  and 
corporate  strategy  (Kovacich,  1997:  56).  Economic  factors  now  drive  aspects  of  information 
warfare  such  as  the  following:  which  resources  to  protect,  cost/benefit  of  different  strategies, 
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which  resources  can  be  compromised,  and  how  to  balance  limited  resources  against  unknown 
threats  (Libicki,  1997:  40).  Game  theory  has  been  used  in  economics  to  model  and  analyze 
similar  decisions  (Gibbons,  1992:  1-2).  But  before  a  more  detailed  application  of  game  theory  to 
information  warfare  can  be  undertaken,  the  game  model  must  be  developed,  tested  and 
evaluated. 

The  first  step  in  developing  the  IW  game  model  is  to  understand  the  basic  elements  of  a 
game  theory  model,  such  as  players,  payoffs,  and  information.  The  next  step  is  to  define  how 
these  basic  elements  are  represented,  in  this  case,  the  normal  and  extensive  forms.  Then,  the 
methods  for  calculating  equilibrium  are  described.  Equilibrium  provides  a  game  theory  model’s 
predictive  power  because  it  shows  what  strategies  each  player  should  use  in  order  to  maximize 
utility.  If  a  game  model’s  equilibrium  does  not  correlate  with  actual  play,  the  game  model  may 
not  be  an  accurate  representation  of  the  underlying  social  situation  (Aumann  and  Maschler, 
1995:  225).  Finally,  game  model  elements,  their  representation,  and  the  equilibrium  calculation 
methodology  are  applied  to  the  context  of  information  warfare  in  order  to  define  the  IW  Game 
Model.  Thus,  the  following  sections  create  a  game  theoretic  foundation  for  the  information 
warfare  game  model  and  for  calculating  its  equilibria  -  Figure  2-1  depicts  the  construction  of  the 
IW  game  model,  as  described  in  the  following  sections. 

2.2  Basic  Game  Theory  Elements 

Game  theory  essentially  provides  a  set  of  tools  and  techniques  for  modeling  and 
analyzing  social  situations.  Although  game  theory  presently  involves  a  multitude  of  different 
techniques,  the  same  basic  components  comprise  all  game  models.  The  main  point  is  to  distill 
the  situation  (in  this  case  IW)  into  formally  defined  sets  that  can  then  be  mathematically 
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IW  Model 


Z _ 

Repeated 

Incomplete  Information 

- Equilibrium - 

Nash  Bayesian 

Equilibrium  Equilibrium 

- Game  Model  Representation - 

Normal  Form  Extensive  Form 

-  Shows  players,  payoffs  and  strategies  -  Depicts  paths  of  play 

- Basic  Game  Theory  Elements - 

Players  Payoffs  Information  Moves/Strategies 

Figure  2-1  Constructing  the  Information  Warfare  Game  Model 

manipulated  (Gibbons,  1997:  128-129).  This  section  describes  the  basic  components  of  game 
theory  to  include  players,  information,  and  payoffs. 

Although  the  players  in  the  game  are  not  strictly  a  part  of  the  game  model  itself,  game 
theory  makes  several  assumptions  that  should  be  noted.  The  players  in  a  game  can  be 
individuals,  informal  teams,  or  formal  organizations;  the  composition  of  the  players  depends 
upon  the  situation  being  modeled  (Bomstein  and  others,  1997:  402).  Basic  game  theory,  as 
formulated  by  Von  Neumann  and  Morgenstem,  generally  assumes  that  players  act  rationally. 
Specifically,  a  player’s  main  goal  is  to  maximize  the  utility  or  value  that  they  can  derive  from  the 
game.  Additionally,  players  generally  assume  that  all  the  other  players  are  also  acting  rationally. 
Assumptions  of  rationality,  while  not  a  perfect  representation  of  human  behavior,  provide  useful, 
generalizable  behavior  approximations  (Erev  and  Roth,  1998:  850).  The  IW  game  model 
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assumes  rational  game  play. 

Information  forms  a  key  component  of  rational  behavior  -  perfect  rationality  requires 
complete  information.  Thus,  the  players  access  to  information  forms  an  important  part  of  the 
game  model.  In  game  theory,  information  regarding  payoffs  and  moves  are  of  primary  concern. 
Perfect  information  means  that  players  know  all  the  actions  available  to  themselves  and  their 
opponents.  Perfect  information  also  involves  the  concept  of  game  history,  which  is  the 
knowledge  of  all  moves  made  thus  far  in  the  game,  also  referred  to  as  perfect  recall.  Complete 
information  means  that  players  know  the  payoffs  available  from  all  possible  courses  of  game 
play  (Gibbons,  1997:  127-128).  Incomplete  information  can  take  on  several  definitions, 
however,  for  this  study  incomplete  information  means  that  players  will  not  know  the  payoffs  of 
their  opponents.  Similarly,  imperfect  information  means  that  players  cannot  directly  observe  the 
actions  of  their  opponents. 

In  games  of  incomplete  information,  such  as  the  IW  game,  players  must  utilize  their 
beliefs  in  order  to  estimate  what  their  opponent’s  payoffs  and  what  moves  they  have  made. 
Game  theory  typically  models  beliefs  as  probability  distribution  functions  over  their  opponent’s 
possible  set  of  moves  and  payoff  structures  (Aumann  and  Maschler,  1995:  71-72).  However,  a 
player’s  beliefs  do  not  have  to  be  strictly  rational  in  order  for  them  play  rationally.  McLennan 
shows  that  short-term  irrational  beliefs  (i.e.  beliefs  that  yield  suboptimal  immediate  payoffs)  are 
justifiable  in  that  they  allow  the  player  to  more  quickly  adjust  their  beliefs  so  that  they  are  more 
accurate  -  thus  increasing  their  long  run  payoffs  (McLennan,  1985:  889-890).  Reny  discusses 
situations  where  players  must  abandon  strictly  rational  beliefs  at  certain  points  in  the  game  to 
achieve  long-term  equilibrium  (Reny,  1995:  1-2).  Player  beliefs  thus  form  a  key  component  of 
games  involving  incomplete  information  (Erev  and  Roth,  1998:  853-855). 
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Payoffs,  the  utility  that  players  receive  from  game  play,  are  the  prime  driver  of  game 
play.  In  purely  rational  game  play,  the  players’  primary  motivation  is  to  maximize  their  payoffs. 
Payoff  representations  must  be  clearly  discernible  and  players  must  be  able  to  immediately  and 
inherently  determine  the  value  of  the  payoffs.  Thus,  most  game  models  represent  payoffs  in 
purely  numeric  or  monetary  terms  (Von  Neumann  and  Morgenstem,  1944:  16).  Expected  utility 
(expected  payoffs)  drives  game  play  in  games  that  involve  incomplete  or  imperfect  information. 
Expected  utility  in  a  game  theory  context  is  a  probability  distribution  over  the  sets  of  all  possible 
strategies  and  their  payoffs.  In  general  terms,  players  will  estimate  the  likelihood  of  each 
possible  course  of  game  play,  discount  their  own  payoff  based  on  their  estimate  and  then  form  a 
strategy  to  obtain  the  highest  expected  payoff  (Gibbons,  1992:  30-31). 

The  payoff  function  of  the  game  captures  all  the  possible  payoffs  in  the  game.  Payoff 
functions  can  be  one  of  three  types:  zero  sum,  constant  sum  or  non-zero  sum.  Zero  sum  games 
involve  players’  whose  goals  directly  conflict;  thus  a  player  can  only  win  what  the  other  player 
loses.  Constant  sum  games  require  that  only  one  player  receive  a  non-zero  payoff  at  any  one 
time.  Non-zero  sum  games  have  no  restrictions  on  the  game’s  payoff  structure  thus  a  player’s 
payoff  is  related  only  to  the  course  of  play  (Aumann  and  Maschler,  1995:224-225).  The  IW 
game  is  a  non-zero  sum  game. 

2.3  Game  Model  Representation 

Now  that  the  game  theory  elements  have  been  described,  the  next  layer  of  the  pyramid  in 
Figure  2-1,  game  model  representation,  can  be  presented.  Game  model  representations  exist  to 
clearly  and  logically  depict  the  elements  (players,  payoffs,  moves,  etc.)  of  the  game  model.  Two 
forms,  the  normal  form  and  extensive  form,  will  be  used  to  represent  the  IW  game  model.  The 
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normal  form  representation  of  a  game  shows  the  game’s  players,  strategies,  and  payoffs 
(Gibbons,  1992:  3).  The  extensive  form  provides  a  richer  device  for  depicting  the  order  of 
moves  and  paths  of  play  in  the  game  (Fudenberg  and  Tirole,  1993:  77-78).  These  two  forms 
simply  capture  different  aspects  of  the  same  game  model  -  using  both  representations  does  not 
signify  two  different  games  (Fudenberg  and  Tirole,  1993:  85). 

In  order  to  demonstrate  these  forms,  the  simple  mixed  pennies  game  will  be  used.  The 
mixed  pennies  game  will  also  be  used  later  to  demonstrate  equilibrium  calculations.  In  this  2- 
player  game,  both  players  have  a  penny.  They  choose  (privately)  which  face,  heads  or  tails,  will 
be  up.  They  then  conceal  the  penny  in  their  hands,  with  the  chosen  face  up.  Finally,  they 
simultaneously  reveal  their  coins.  If  the  pennies  match,  (i.e.  same  face  showing)  player  1  gets 
both  pennies.  Otherwise,  player  2  gets  both  pennies. 


Table  2-1  Normal  Form  for  Mixed  Pennies  Game 


Player  1 

Player  2 

Heads 

Tails 

Heads 

-1,1 

1,-1 

Tails 

1,-1 

-1,1 

Strategy  Set  -  S 

S  =  (Heads,  Tails) 

Payoff  Function  -  |Uj 

PiC?/,  s2) 

where  i  indicates 

-  e.g.  pi(Heads,  Heads)  =  -1 

the  player 

Table  2.1  shows  the  normal  form  for  the  matching  pennies  game.  Other  elements  can  be 
expressed  in  the  normal  form,  such  as  the  probability  of  each  strategy  being  played  or 
information  (Gibbons,  1992:  33).  The  normal  form  representation  of  these  other  elements  will  be 
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described  when  they  are  used.  Figure  2-2  shows  the  extensive  form  for  the  mixed  pennies  game. 


Figure  2-1  Extensive  Form  for  Mixed  Pennies  Game 


The  extensive  form  is  particularly  useful  in  games  where  the  order  of  moves  (e.g.  chess)  is  very 
important  and  directly  effects  the  options  available  for  the  other  player. 

2.4  Equilibrium  and  Strategy 

The  game  model  elements  and  representations  shown  above  provide  the  pieces  for 
describing  and  performing  equilibrium  calculations.  The  equilibrium  of  a  game  shows  the  move 
or  combination  of  moves  that  maximizes  each  player’s  payoffs.  A  game  reaches  equilibrium,  in  a 
game  theoretic  sense,  when  each  player’s  strategy  is  strategically  stable  and  self-enforcing.  A 
strategically  stable  or  self-enforcing  strategy  implies  that  no  player  can  benefit  by  deviating  from 
the  equilibrium  strategy.  Equilibrium  strategies  are  sometimes  referred  to  as  best  response 
strategies  because  each  player  plays  a  strategy  that  they  predict  is  the  best  response  to  their 
opponent’s  predicted  strategy.  Game  theory  refers  to  the  equilibrium  concept  described  above  as 
Nash  equilibria.  Determining  the  Nash  equilibrium  of  a  game  essentially  involves  solving  the 
game  -  finding  a  unique,  optimal  course  of  play  for  each  player  (Gibbons,  1992:  8).  The  Nash 
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equilibrium  is  the  basic  equilibrium  form  of  game  theory  and  most  other  forms  of  equilibrium 
are  extensions  of  it.  Nash  proved  that  an  equilibrium  point  exists  in  all  strategic,  normal  form 
games  (Gibbons,  1992:  33). 

Information  warfare  demonstrates  equilibrium  behavior  when  opponents  realize  that  they 
must  account  for  their  opponent’s  strategy  when  selecting  their  own.  For  instance,  suppose  there 
is  a  computer  hacker  who  is  equally  expert  at  the  two  strategies  of  breaking  into  a  particular 
company’s  network  and  at  obtaining  company  passwords  (he  can  only  do  one  of  these  strategies 
at  a  time).  Assume  that  the  hacker  will  realize  a  very  high  payoff  by  penetrating  the  network  but 
receive  a  much  smaller  payoff  by  obtaining  passwords.  Further  assume  that  the  company  will 
realize  a  large  loss  if  their  network  is  penetrated  and  a  much  smaller  loss  if  they  lose  some  of 
their  passwords.  Also  suppose  that  the  target  company  knows  the  hacker’s  strategies  and 
employs  a  strategy  to  make  their  network  impenetrable. 

The  equilibrium  in  this  “game”  is  for  the  hacker  to  obtain  passwords  and  the  company  to 
protect  their  network,  so  long  as  the  situation  remains  as  described  above.  Although  the  hacker 
would  get  a  much  higher  payoff  by  penetrating  the  network,  the  company’s  network  defense 
strategy  prevents  him  from  realizing  any  payoff  from  this  attack.  So,  the  hacker  will  obtain 
passwords  so  that  he  can  at  least  obtain  some  payoff.  Likewise,  the  company  will  maintain  their 
network  defense  because  they  would  much  rather  suffer  the  small  password  loss  than  the  large 
network  loss.  One  can  see  that  neither  party  can  benefit  by  deviating  from  their  strategy,  so  this 
information  warfare  scenario  is  in  equilibrium.  The  following  sections  present  a  more  formal 
analysis  of  equilibrium  and  equilibrium  calculation. 
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2.4.1  Calculating  Nash  Equilibrium 

Elimination  of  dominated  strategies  was  the  first  approach  to  finding  a  game’s 
equilibrium.  A  dominated  strategy  is  a  strategy  that  cannot  benefit  a  player  regardless  of  the 
course  of  play  or  the  opponent’s  moves.  A  strongly  dominated  strategy  yields  payoffs  that  are 
lower  than  all  other  strategies,  regardless  of  the  opponent’s  move.  Thus,  a  player  can  never 
benefit  by  playing  a  strongly  dominated  strategy.  Weakly  dominated  strategies  yield  payoffs  that 
are  generally  lower  than  all  other  strategies.  Table  2.2  shows  dominated  strategies  in  a  payoff 
matrix  (Player  1  payoffs  listed  first,  strongly  dominated  strategies  are  italicized). 

Table  2-2  Dominated  Strategies 


Player  1 

Player  2 

Strategy  1 

Strategy  2 

Strategy  3 

Strategy  Payoff 
Sum  -  Player  2 

Strategy  A 

3,1 

0,2 

0,3 

6 

Strategy'  B 

0,0 

0,0 

2,0 

0  -  Strongly 

Dominated 

Strategy  C 

2,3 

0,0 

0,1 

4  -  Weakly 

Dominated 

Strategy  Payoff 
Sum  -  Player  1 

5 

0  -  Strongly 
Dominated 

2  -  Weakly 
Dominated 

Theoretically,  all  strategies  other  than  the  equilibrium  strategy  are  either  strictly  or 
weakly  dominated.  Thus,  a  careful,  iterated  elimination  of  dominated  strategies  yields  the  Nash 
equilibrium  solution  of  the  game.  However,  finding  dominated  strategies  can  be  unintuitive  or 
impossible,  particularly  in  games  of  incomplete  information  (Gibbons,  1992:  9-13;  Fudenberg 
and  Tirole,  1993:  437).  Nonetheless,  elimination  of  dominated  strategies  forms  a  key  part  of 
determining  the  equilibria  for  this  study’s  information  warfare  model. 
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2.4.2  Bayesian  Equilibrium 


Bayesian  equilibrium  extends  the  Nash  equilibrium  concept  to  account  for  instances 
when  players  cannot  calculate  their  opponent’s  strategy  with  certainty.  Incomplete  information 
or  the  structure  of  the  game  can  cause  this  uncertainty.  Bayesian  equilibrium  consists  of  mixed 
strategies.  A  mixed  strategy  is  a  probability  distribution  over  all  actions  in  the  strategy  set. 
Actions  may  have  0  probability  associated  with  them,  meaning  that  they  will  not  be  played  under 
any  circumstance.  A  mixed  strategy  that  assigns  probability  1  to  an  action  means  only  that 
single  strategy  is  played;  this  is  a  pure  strategy  (Gibbons,  1992:  150). 

The  mixed  pennies  game  described  above  in  Table  2-1  and  Figure  2-2  has  no  pure 
strategy  Nash  equilibrium.  The  following  process  shows  the  mixed  strategy  calculation  for  this 
game.  Suppose  player  1  thinks  that  player  2  will  play  heads  with  probability  p  and  tails  with 
probability  1  -  p.  Using  the  payoff  matrix,  player  1  ’s  payoff  from  playing  heads  is  p  *  (-1)  +  (1  - 
p)  *1  =  1-  2p;  player  1  ’s  payoff  from  playing  tails  is  2p  -  1.  Solving  the  inequality  1  -  2p  >  2p 
-  1  shows  that  player  1  will  play  heads  if  p  <  Vi  and  is  indifferent  when  p  =  'A.  Thus,  player  l’s 
mixed  strategy  involves  player  1  drawing  p  randomly  from  the  interval  (0,1)  and  selecting  his 
strategy  according  to  the  above  rules  (Gibbons,  1992:  33). 

2.5  Game  Model  of  this  Study  -  Repeated  Game  with  Incomplete  Information 

The  preceding  sections  present  a  brief  overview  of  basic  game  theory  -  its  elements,  how 
to  represent  those  elements,  and  how  to  use  the  elements  and  representation  to  calculate 
equilibrium.  The  repeated  game  with  incomplete  information  extends  basic  game  theory  to 
account  for  more  complex,  realistic  social  situations.  It  is  one  of  the  better-understood  models  in 
game  theory  and  can  be  a  good  approximation  of  some  long-term  social  situations  (Fudenberg 
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and  Tirole,  1993:  145). 

The  incorporation  of  incomplete  information  represents  the  most  significant  extension  of 
the  repeated  game  model.  Two  major  findings  form  the  foundation  for  game  theory’s  treatment 
of  incomplete  information.  All  information,  in  a  game  theoretic  sense,  can  be  captured  in  the 
payoff  function  of  the  game.  Thus,  one  can  model  any  lack  of  information  as  an  imperfect 
knowledge  of  payoff  functions.  Second,  the  addition  of  a  chance  mechanism  to  basic  game 
models  could  allow  the  modeling  of  incomplete  information  without  the  development  of  an 
entirely  new  game  model  (Aumann  and  Maschler,  1995:  67). 

The  repeated  game  with  incomplete  information  model  was  selected  as  the  foundation  for 
the  information  warfare  game  model  for  two  primary  reasons.  First,  this  model  focuses  on  the 
role  of  information;  specifically,  how  should  one  employ  their  information,  how  should  one 
protect  their  information  and  how  does  one  proceed  when  they  lack  complete  information 
(Aumann  and  Maschler,  1995:  155).  Information  warfare  centers  on  these  same  issues.  Second, 
the  model  incorporates  time  (in  the  form  of  game  repetitions)  and  how  time  affects  game  play 
(Gibbons,  1992:  80).  Information  warfare  also  takes  place  over  time.  For  instance,  a  hacker  may 
first  probe  a  network  to  detect  any  weaknesses  and  then  launch  various  attacks  in  an  attempt  to 
determine  the  best  penetration  strategy  -  time  plays  an  important  role  in  how  the  hacker  attacks 
the  network  (Libicki,  1997:  40). 

2.5.1  Representation  of  Incomplete  Information 

The  concept  of  player  types  represents  information  unknown  to  the  other  players. 
Specifically,  the  player’s  type  designates  their  particular  payoff  function  and  the  set  of  all  player 
types  represents  all  possible  payoff  functions.  Recent  research  has  extended  the  notion  of  player 
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types  to  encompass  differing  player  beliefs,  differing  strategy  sets  and  many  other  possible 
unknowns;  however,  unknown  payoff  functions  will  be  this  study’s  focus.  Players  may  or  may 
not  know  all  of  their  own  or  their  opponent’s  possible  types;  in  fact  they  may  not  know  their  own 
type  until  far  into  the  game  (Aumann  and  Maschler,  1995:  156-158). 

At  the  game’s  outset,  each  player’s  actual  type  is  determined  by  chance.  A  probability 
distribution  function  exists  over  the  set  of  player  types  that  associates  a  probability  estimate  for 
the  “choice  of  chance”  at  the  game’s  outset.  The  player  type  probability  distribution  function 
can  play  an  important  part  of  equilibrium  calculation  in  these  games  (Fudenberg  and  Tirole, 
1993:213-214). 

Baseball  batters  provide  a  good  example  of  player  types.  When  a  pitcher  faces  a  new 
hitter,  they  do  not  know  if  they  are  facing  a  power  hitter  such  as  Mark  McGuire  or  a  contact 
hitter  such  as  Tony  Gwynn  (this  example  ignores  scouting  reports  and  other  hitting  styles).  They 
must  make  a  guess  (captured  in  the  game  model  by  the  choice  of  chance)  about  the  hitter’s  type 
and  pitch  accordingly.  In  the  beginning,  they  assume  that  there  is  a  50-50  chance  of  the  hitter 
being  each  type.  As  the  at-bat  proceeds,  they  will  be  able  to  refine  their  guess  about  the  hitter’s 
type  based  on  what  they  observe.  For  example,  if  the  pitcher  begins  to  suspect  that  the  hitter  is  a 
power  hitter,  they  could  assign  more  probability  to  the  power  hitter  type. 

The  differing  payoff  functions  (for  each  player  type)  create  a  different  game  for  each 
intersection  of  player  types.  A  matrix  over  all  possible  player  types,  as  shown  in  Table  2.3, 
represents  all  possible  games  that  can  arise  from  the  intersections  of  the  different  player  types. 
For  instance,  there  is  a  power  hitter  vs.  power  pitcher  “game”  and  a  power  hitter  vs.  feel  pitcher 
“game”.  Each  of  the  games  in  the  matrix  will  have  its  own  actual  payoffs  and  equilibrium.  The 
probability  of  each  game  in  the  matrix  (i.e.  each  cell)  being  the  actual  game  played  is  the 
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conditional  probability  of  each  player’s  type  as  shown  in  Table  2.3.  In  the  game  selection  or 
player  type  matrix  shown  in  Table  2.3,  each  player  can  be  one  of  two  possible  types,  thus  four 
possible  games  or  matchups  can  actually  be  played  (Aumann  and  Maschler,  1995.  70-73). 

Table  2-3  Game  Selection  Matrix 


Pitcher  Type  and  Probability 

Hitter  Type 

“Power”  Pitcher  (PP) 

“Feel”  Pitcher  (FP) 

and  Probability 

P(PP)  =  n 

P(FP)  =  1-r) 

Power  Hitter  (PH) 

G„ 

G21 

P(PH)  =  8 

P(Gn)  =  ris 

P(G2,)  =  (l-tl)s 

\  /  _ _ _ 

Contact  Hitter  (CH) 

G12 

G22 

P(CH)  =  1-s 

P(G,2)  =  ti(1-s) 

P(G22)  =  (l-T|)(l-s) 

2.5.2  Equilibrium  in  the  Repeated  Game  with  Incomplete  Information  -  Single  Repetition 

Although  the  above  matrix  shows  four  different  games  that  can  be  played,  it  must  be 
pointed  out  that  only  one  game  is  actually  being  played.  The  matrix  is  simply  a  tool  used  to 
represent  the  players’  lack  of  knowledge  about  payoff  functions.  To  further  illustrate  the 


Figure  2-3  Repeated  Game  Extensive  Form 
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relationship  between  the  above  Player  Type  matrix  and  the  game  being  played,  consider  the 
extensive  form  representations  of  game  Gn  and  game  G21  in  Figure  2.3.  Note  that  the  hitter  is 
the  same  type  in  both  games,  a  power  hitter.  The  example  also  assumes  that  the  bases  are  loaded 
with  no  outs.  The  payoffs  represent  runs  and  runs  batted  in  for  the  hitter  and  outs  for  the  pitcher. 

In  this  case,  chance  has  determined  that  the  hitter  is  a  power  hitter.  The  pure  Nash 
equilibrium  for  each  game  is  highlighted  above.  To  continue  the  analysis  from  the  perspective  of 
the  hitter,  one  can  see  that  a  mixed  strategy  will  be  played.  Since  the  hitter  does  not  know  what 
type  of  pitcher  he  is  facing,  he  must  use  both  his  swings.  The  probability  associated  with  each 
game  (i.e.  the  probability  assigned  to  each  pitcher  type)  will  determine  the  mix  of  swings.  From 
the  player  type  matrix,  P(Gi  1)  =  ps  and  P(G2i)  =  (l-p)s.  The  expected  utility  for  the  hitter  taking 
a  big  swing  is  pe(l)  +  (l-p)e(O)  =  pe;  likewise,  the  expected  utility  from  a  cut  swing  is  pe(0)  + 
(l-p)e(2)  =  2e  -  2pe.  These  calculations  are  examples  of  the  Von  Neumann-Morgenstem  utility 
function  (Bloomfield,  1994:  413). 

The  hitter  will  take  a  big  swing  when  the  expected  utility  of  the  big  swing  >  cut  swing. 
Solving  ps  >  2s  -  2ps  yields  p  >  2/3.  Thus,  the  hitter’s  mixed  strategy,  when  he  is  a  power  hitter 
is  as  follows.  He  randomly  selects  p  from  the  interval  (0..1),  if  p  >  2/3,  then  he  takes  a  big 
swing,  otherwise  he  takes  a  cut  swing.  Although  modem  power  hitters  almost  always  take  a  big 
swing,  power  hitters  such  as  Ted  Williams  would  reserve,  their  big  swing  and  realized  better 
overall  numbers  as  a  result.  Note  that  the  above  example  was  created  for  this  report,  however 
the  method  of  calculation  is  drawn  from  Aumann  and  Maschler  (Aumann  and  Maschler,  1995: 
253-257). 
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2.5.3  Equilibrium  with  Repetition 

The  above  example  shows  one  repetition  of  the  game  (i.e.  one  pitch).  Now  repeated 
repetitions  are  accounted  for  in  the  model.  The  model  actually  assumes  an  infinite  number  of 
repetitions,  also  referred  to  as  an  infinite  horizon.  More  accurately,  the  concept  of  infinite 
repetition  refers  to  the  players’  belief  about  the  number  of  repetitions;  if  players  know  the 
number  of  repetitions,  overall  game  play  may  change  (Gibbons,  1992:  88).  In  the  repeated  case, 
players  attempt  to  maximize  their  payoffs  over  the  long  run.  Additionally,  they  will  use 
information  gained  through  repeated  game  play  to  refine  their  beliefs  about  their  opponent’s  type 
(Fudenberg  and  Tirole,  1993:  214). 

In  the  above  baseball  example,  the  hitter  would  observe  the  pitches  thrown,  the  velocity 
of  pitches,  etc.  and  refine  the  estimate  of  r|  (recall  that  r|  is  the  probability  that  the  pitcher  is  a 
power  pitcher)  as  the  at  bat  proceeds.  For  instance,  if  they  were  facing  a  power  pitcher,  r)  would 
increase  over  time.  So  instead  of  selecting  r)  from  the  interval  (0..1),  he  would  select  from  the 
interval  (0.25..  1),  decreasing  the  interval  to  (0.667..  1),  which  means  he  would  always  take  a  big 
swing  (since  rj  would  always  be  greater  than  2/3)  -  reaching  equilibrium  for  that  game  (Gibbons, 
1992:  154). 

2.6  IW  Model  Overview 

At  this  point,  all  the  basic  pieces  are  in  place  for  the  construction  of  the  information 
warfare  model.  As  mentioned  in  the  repeated  game  model  introduction,  the  information  warfare 
model  is  based  on  the  class  of  repeated  games  of  incomplete  information  as  described  in  section 
2.5.  However,  several  modifications  and  extensions  have  been  made  to  the  basic  model  so  that  it 
can  better  fit  information  warfare.  The  following  sections  describe  the  IW  Model. 
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2. 6. 1 IW  Model  Features 


The  IW  Model  involves  probabilistic  strategies.  Classical  game  theory  assumes  that 
strategies  are  always  successful;  the  actions  of  the  opponent  may  affect  the  outcome,  but  the 
strategy  itself  is  not  called  into  question.  In  many  cases,  such  as  information  warfare,  the  actions 
themselves  will  not  always  succeed  -  regardless  of  the  opponent’s  actions.  Probabilistic 
outcomes  could  have  a  strong  impact  on  game  play.  Specifically,  players’  risk  aversion  will 
have  a  much  stronger  impact  on  strategy.  For  instance,  a  risk-seeking  individual  is  much  more 
likely  to  play  a  strategy  that  has  a  high  payoff  but  a  low  probability  of  success.  Theoretically, 
the  game  model  can  capture  behaviors  such  as  risk  aversion  (Aumann  and  Maschler,  1995:  67). 
However,  this  concept  has  not  been  experimentally  tested. 

The  IW  Model  also  involves  the  related  concepts  of  symmetric  incomplete  information 
and  symmetric  strategies.  This  concept  means  that  both  players  are  ignorant  of  their  opponent’s 
type,  payoffs  and  moves.  The  majority  of  both  theoretical  and  experimental  research  involves 
one-sided  incomplete  information  (Aumann  and  Maschler,  1995:  224-225).  Symmetric 
strategies  involve  games  in  which  the  players’  strategies  have  no  direct  relationship  with  each 
other.  The  IW  Model’s  strategies  are  diametrically  opposed.  Specifically,  each  strategy  directly 
counters  a  specific  strategy  of  the  opponent.  Information  warfare  provided  the  motivation  for 
this  concept  since  information  defenders  can  develop  specific  strategies  to  thwart  a  certain  type 
of  attack. 

2.6.2  IW  Model  Components 

First,  the  IW  Model’s  player  definitions  are  provided.  Player  1  is  the  Defender  and 
Player  2  is  the  Attacker.  Defenders  attempt  to  protect  the  information  that  is  most  valuable  to 
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them  and  attackers  attempt  to  obtain  information  valuable  to  them.  There  are  three  types  of  each 
player:  social,  infrastructure  and  node.  Each  player  type  prefers  one  type  of  information  to  all 
others  (i.e.  realizes  higher  payoffs  for  defending/obtaining  it).  Additionally,  attackers  and 
defenders  of  the  same  type  will  have  the  same  relative  ranking  of  information,  but  the  actual 
valuation  of  the  information  will  differ.  These  divisions  are  drawn  from  IW  literature,  as 
indicated  below. 

The  Social  player  type  refers  to  a  player  who  prefers  to  obtain  or  protect  personal  or 
sensitive  information  such  as  passwords,  names,  phone  numbers,  etc.  This  information  cannot 
be  directly  used  against  systems  but  may  be  harmful  nonetheless.  Institutions  such  as  banks  or 
insurance  companies  would  be  social.  This  player-type  is  based  upon  the  prevalent  social 
engineering  infonnation  warfare  tactic  that  typically  involves  low-tech  infiltration  such  as  using 
false  identities,  facility  intrusion,  or  email  scams.  For  example,  a  common  hacking  technique 
involves  a  hacker  calling  an  employee  while  claiming  to  be  a  system  administrator  and 
requesting  the  employee’s  passwords.  Social  engineering  is  the  cheapest  and  easiest  method  of 
information  warfare  (Kivacich,  1996:  5;  Cohen,  1995:  WWWeb). 

The  Infrastructure  player  type  refers  to  a  player  who  prefers  to  obtain  or  protect 
information  relating  to  the  computer  network  itself  such  as  Internet  addresses,  network 
architecture,  or  TCP/IP  port  assignments.  Organizations  such  as  telecommunications  companies 
or  Internet  service  providers  would  be  this  type  of  player.  Although  technically  challenging  and 
risky  (i.e.  high  risk  of  detection  and  legal  prosecution),  infrastructure  or  network  attacks  can  be 
very  costly,  even  devastating,  to  the  victim  (Kivacich,  1996:  5;  Cohen,  1995:  WWWeb). 

The  Node  player  type  refers  to  players  who  prefer  to  obtain  information  relating  to 
computer  equipment  such  as  hardware  addresses,  computer  configurations,  file  names  or 


encryption  keys.  Companies  performing  data  processing,  graphics  or  other  computer  aided 
design  and  software  development  would  be  this  type  of  player.  For  instance,  a  hacker  that 
obtained  a  computer’s  hardware  address  and  configuration  files  (e.g.  IO.SYS,  AUTOEXEC.BAT 
m  Microsoft  Windows)  could  remotely  administer  or  disable  that  computer  (this  is  a  known 

problem  of  Microsoft’s  Internet  Explorer)  (Microsoft  Corporation,  1998:  WWWeb;  Cohen, 
1995:  WWWeb). 

A  further  distinction  is  made  between  the  defenders  and  attackers  in  the  IW  Model. 
Information  defenders  in  the  corporate  world  generally  have  an  array  of  sensing  and  logging 
technology  (e.g.  security  audit  logs,  network  sniffers,  intrusion  detection  systems,  etc.)  that  allow 
them  to  observe  attacks  against  them  (Cohen,  1995:  WWWeb).  The  IW  Model  accounts  for  this 

by  allowing  defenders  to  determine  the  attacker’s  move  by  carefully  observing  the  payoffs  they 
(the  defender)  receive. 

Now  the  actions  available  to  players  are  described.  Defenders  have  three  possible 
actions:  1)  Social  Engineering  Defense,  2)  Infrastructure  Defense  and  3)  Node  Defense.  In  the 
experiment,  players  will  be  provided  with  descriptions  of  their  actions.  For  instance,  a  social 
engineering  defense  could  involve  employee-training  programs,  phone  monitoring,  and  increased 
physical  security.  Again,  all  the  defense  strategies  allow  the  defender  to  observe  the  attacker’s 
move.  Likewise,  attackers  also  have  three  possible  actions:  1)  Social  Engineering  Attack,  2) 
Infrastructure  Attack  and  3)  Node  Attack.  These  actions  show  the  symmetric  nature  of  the  IW 
Model  described  earlier.  As  discussed  previously,  each  action  will  have  a  probability  of  success 
associated  with  it.  Since  the  player’s  type  determines  the  value  of  the  information  received  from 
each  action,  player  type  will  determine  the  player’s  preferred  strategy.  However,  the  preferred 
strategy  may  not  yield  the  highest  payoffs  during  actual  game  play.  This  results  from  the  actions 
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of  the  opponent,  whose  strategy  may  impede  the  player’s  ability  to  play  the  preferred  strategy. 
In  fact,  this  will  generally  be  the  case.  Players  will  know  all  the  actions  available  to  their 
opponent. 

Finally,  the  payoffs  for  the  IW  Model  are  defined  in  general  terms.  For  this  game, 
players  attempt  to  obtain  or  defend  information  important  to  them.  The  information’s  value 
depends  upon  the  player’s  type;  for  simplicity,  each  piece  of  information  will  be  worth  a  certain 
amount  of  US  dollars.  Specific  types  of  information  will  be  specified  in  the  actual  games,  but  in 
any  game,  there  will  be  three  types  of  information  to  be  defended  and  attacked,  social 
information  (passwords,  employee  information,  etc.),  infrastructure  information  and  node 
information.  The  relative  value  of  each  piece  of  information  within  and  between  player  types 
will  be  manipulated  in  the  experiment,  as  discussed  later.  For  example,  a  Social-type  Attacker, 
who  successfully  obtains  his  opponent’s  password  (a  social  piece  of  information)  could  gain  $70 
while  his  opponent,  a  Node-type  Defender,  loses  $30.  The  IW  Model  is  a  non-zero  sum  game, 
more  accurately  modeling  the  real-world  situation  (Aumann  and  Maschler,  1995:  157). 

Each  action’s  success  probability  will  determine  the  expected  payoff  (expected  utility)  of 
a  particular  action.  Players  will  not  know  the  game  s  success  probabilities  for  themselves  or 
their  opponent.  Thus,  players  must  refine  their  expected  utility  calculations  as  the  game 
proceeds.  This  game’s  success  probabilities  allow  an  action  to  either  succeed  or  fail  -  if  the 
action  fails,  the  player  gains  nothing,  if  the  action  succeeds  they  gain  their  full  payoff.  From  the 
example  above,  if  the  social  attack  succeeds,  that  attacker  gains  $70  and  the  defender  loses  $30 
(i.e.  the  social  defense  failed).  However,  if  the  social  defense  succeeds,  neither  player  gains  or 
loses  anything  (obviously  this  is  a  win  for  the  defender). 
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2. 7  General  IW  Model  Definition  and  Notation 

This  section  presents  the  general  IW  Model.  The  general  model  defines  inherent  characteristics 
of  the  IW  Model  such  as  the  affect  of  player  type,  course  of  play,  and  payoff  calculations. 

2. 7. 1  Player  Type  Selection 

Section  2.5.1  discussed  player  type  or  game  matrices  that  show  the  conditional  probability  of 
each  possible  game;  the  matrix  cells  represent  each  possible  combination  of  Attacker  and 
Defender  types.  The  matrix  for  this  game  is  similar  to  the  example  described  in  previous 
sections.  Again,  the  players  are  actually  playing  one  game,  but  their  differing  and  unknown 
types  allow  for  many  different  payoff  combinations.  Table  2-4  shows  the  Game  Selection 
Matrix  for  the  IW  Model,  note  that  G  in  the  table  means  Game. 


Table  2-4  IW  Model  Game  Selection  Matrix 


Attacker  Types 

Defender 

Types 

As(Social)  P(AS)  —  T\ 

Al(lnfrastructure)  P(Aj)  —  £ 

AN(Node)  P(An)  =  p 

Tl,£,p>0; 

r|+s+p  =  1 

Ds  P(DS)  =  k 

Gss  P(GSs)  =  r|K 

Gsi  P(Gsi)  =  SK 

Gsn  P(Gsn)  =  PK 

D,  P(D,)  =  t 

G|S  P(G|s)  =  T]T 

Gn  P(Gu)  =  st 

Gjn  P(Gin)  =  pt 

Dn  P(Dn)  =  cp 

Gns  P(Gns)  =  pep 

Gnj  P(Gnj)  =  stp 

Gnn  P(Gnn)  =  p<p 

K,T,<p  >  0 

K+T+(p  =  1 

The  game  selection  matrix  is  presented  mostly  for  completeness  in  developing  the  IW 
Model.  In  this  study,  it  will  have  no  affect  on  game  play  or  equilibrium  calculations.  The  reason 
for  this  is  that  players  are  only  aware  of  the  payoff  function  in  the  game  that  they  are  actually 
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playing.  In  order  to  utilize  a  game  selection  matrix  in  equilibrium  calculations,  players  must 
know  all  the  possible  payoff  functions  (Aumann  and  Maschler,  1995:  210).  Additionally, 
players  will  only  play  one  stage  game  throughout  the  experiment,  that  is  to  say  that  their  type 
will  not  change  during  repetitions  of  the  game.  Since  this  study  does  not  develop  a  generalized 
equilibrium,  the  game  selection  matrix  is  not  directly  relevant.  Nonetheless,  its  presentation  is 
important  for  model  completeness  and  for  model  refinement  in  subsequent  research. 

2. 7.2  General  Extensive  Form 

Figure  2-4  shows  the  general  extensive  form  of  the  game.  The  payoff  nodes  represent  the 
specific  pieces  of  information.  Their  actual  value  will  depend  upon  which  game  (from  the  game 
selection  matrix)  is  being  played.  Its  important  to  note  that  the  extensive  form  for  the  IW  Model 
does  not  indicate  order  of  moves,  both  players  move  simultaneously  in  this  game. 

The  payoffs  shown  in  the  tree  (social,  infrastructure,  and  node)  are  determined  based 


Notation: 

A1  -  Social  Engineering  Defense 

Ell  -  Social  Engineering  Attack 

A2  -  Infrastructure  Defense 

112  -  Infrastructure  Attack 

A3  -  Node  Defense 

E13  -  Node  Attack 
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Figure  2-2  IW  Model  Extensive  Form 


upon  the  actual  game  being  played  (from  the  game  matrix)  and  the  path  of  play.  In  other  words, 
the  course  of  game  play  and  the  players’  types  determine  the  actual  and  expected  payoff  values. 
For  example,  at  payoff  node  Social  1  (the  numbers  are  used  to  distinguish  the  nodes,  they  do  not 
imply  different  information)  the  defender’s  actual  payoff  is  determined  by  the  value  of  social 
information  (names,  addresses,  passwords,  etc.)  in  the  game  G.  Similarly,  the  attacker’s  actual 
payoff  is  determined  by  the  value  of  social  information  in  the  game  G.  Expected  payoffs 
(expected  utility)  are  calculated  by  multiplying  the  action’s  success  probability  by  its  actual 
payoff. 

2. 7.3  General  Normal  Form 

Table  2-5  shows  the  General  Normal  Form  for  the  IW  Model.  Each  cell  of  the  matrix 
shows  the  payoffs  that  both  players  will  realize  from  that  course  of  play.  Additionally,  the 

Table  2-5  IW  Model  General  Normal  Form 


Defender 

Attacker 

Social  Defense 

Infrastructure  Defense 

Node  Defense 

Social 

Attack 

P(9(A1)=1)  *  Social  Info 

P(  3(171  )=1)  *  Social  Info 

P(9(A1)=1)  +  P(9(IH)=1)=1 

P(9(A2)=1)  *  Social  Info 

P(3(I2l)=l)  *  Social  Info 

P(9(A2)=1)  +  P(9(ni)=l)  =  1 

P(9(A3)=1)  *  Social  Info 

P(3(Hl)=l)  *  Social  Info 

P(9(A3)=1)  +  P(9(ni)=l)  =  1 

Infrastructure 

Attack 

P(9(A1)=1)  *  Infra.  Info 

P(3(I72)=1)  *  Infra.  Info 

P(9(A1)=1) +  P(9(n2)=l)  =  1 

P(9(A2)=1)  *  Infra.  Info 

P(3(/72)=l)  *  Infra.  Info 

P(9(A2)=1)  +  P(9(ri2)=l)=  1 

P(9(A3)=1)  *  Infra.  Info 

P(S(IT2)=1)  *  Infra.  Info 

P(9(A3)=1)  +  P(9(n2)=l)  =  1 

Node 

Attack 

P(9(A1)=1)  *  Node  Info 

P(9(FB)=1)  *  Node  Info 

P(9(A1)=1)  +  P(9(n3)=l)  =  1 

P(9(A2)=1)  *  Node  Info 

P( 9(IB)=1)  *  Node  Info 

P(9(A2)=1)  +  P(9(I13)=1)  =  1 

P(9(A3)=1)  *  Node  Info 

P(3(IB)=1)  *  Node  Info 

P(9(A3)=1)  +  P(9(I13)=1)  =  1 

realized  payoff  is  discounted  by  the  success  probability  of  the  action  being  played  to  yield  the 
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expected  utility.  Thus,  the  payoffs  shown  below  are  expected  payoffs,  not  actual  payoffs.  Table 
2-5  lists  the  Defender’s  payoff  above  the  Attacker  payoff;  for  additional  clarity  the  Attacker’s 
payoffs  are  in  a  different  font  than  the  Defender’s. 

The  symbol  &  represents  the  strategy  success  function,  for  example  &(A1)  =  1  means  that 
the  Defender  strategy  A1  (Social  Engineering  Defense)  succeeded;  conversely,  S(A1)  =  0  means 
that  the  Defender  Strategy  A1  failed.  Thus,  the  notation  P(3(A1)  =  1)  means  the  probability  that 
A1  will  succeed.  Recall  that  only  one  player’s  strategy  can  succeed  for  any  course  of  play  (i.e. 
the  attack  succeeds  and  the  defense  fails  or  vice-versa). 

Two  important  facts  should  be  noted  from  the  normal  form  for  the  IW  Model.  First,  the 
attacker,  in  effect,  determines  the  payoff  that  the  defender  receives.  This  is  because  it  is  the 
attacker  who  decides  what  information  to  seek,  the  defender  can  only  attempt  to  defend  that 
information  by  utilizing  the  best  defense  strategy  for  the  information  sought  by  the  attacker. 
Second,  as  noted  before,  the  defender  can  determine  the  attacker’s  strategy  by  observing  their 
payoffs  (i.e.  they  will  know  whether  they  lost  social,  infrastructure  or  node  information).  This 
additional  information  should  allow  the  defender  to  reach  their  equilibrium  strategy  more  quickly 
than  the  attacker. 

2.8  IW  Model  Equilibrium  Calculations 

This  section  describes  the  equilibrium  calculations  used  for  the  IW  Model,  based  on  the 
elements  and  representations  shown  in  previous  sections.  Three  specific  games  are  developed 
from  the  IW  Model  in  order  to  test  the  hypotheses  presented  later  in  chapter  2.  These  games 
each  have  different  equilibria  that  were  produced  by  changing  the  expected  payoffs  for  each 
action.  Specifically,  each  action’s  payoff  and  success  probability  was  manipulated  to  yield  the 
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various  equilibrium  points  required  to  test  the  study’s  hypotheses.  Essentially,  each  of  three 
games  are  different  player  type  matchings,  so  they  represent  different  cells  from  the  game 
selection  matrix.  Before  presenting  these  games  and  their  equilibrium  strategies,  the  equilibrium 
methodology  applied  to  all  the  games  is  discussed. 

First,  the  fact  that  a  finite  (fixed  number  of  actions  and  players)  game  in  strategic,  normal 
form  (as  in  Table  2-5)  has  at  least  one  equilibrium  point  must  be  reemphasized.  This  is  the  Nash 
Existence  Theorem,  the  proof  is  omitted  here,  but  can  be  found  in  Gibbons,  Myerson  and  other 
game  theory  texts  (Gibbons,  1992:  45-48;  Myerson,  1991:  95-98).  Calculating  the  actual 
equilibria  involves  the  following  3  steps:  1)  Eliminate  strongly  dominated  strategies,  2)  Develop 
strategy  support  sets  3)  Develop  a  probability  distribution,  or  strategy  randomization,  that  yields 
the  highest  possible  payoff.  A  strategy  support  set  contains  all  the  moves  that  will  be  used  in 
game  play;  these  are  also  referred  to  as  equilibrium  supports.  The  strategy  randomization  across 
the  support  set  provides  the  probability  that  a  player  will  make  each  particular  move  in  the 
support  set  (Myerson,  1991:  98). 

Although  this  probability  distribution  is  often  referred  to  as  strategy  randomization,  one 
should  not  infer  that  player’s  make  moves  based  on  some  random  event,  such  as  the  throw  of  a 
die  (Gibbons,  1992:  38-45;  Myerson,  1991:  91-94).  Rather,  the  strategy  randomization  shows 
players’  uncertainty  about  their  opponent’s  next  move.  For  instance,  a  baseball  pitcher  does  not 
flip  a  coin  to  decide  between  a  fast  ball  and  a  curve  ball.  The  pitcher  instead  makes  a  “guess” 
about  what  the  hitter  may  be  looking  for  and  pitches  accordingly  (this  analogy  ignores  issues 
such  as  scouting,  coaching,  etc.).  Developing  the  best  response  strategy  profile  is  relatively 
straightforward,  however,  a  shareware  software  tool  (Gambit)  was  used  to  verify  the  manual 
calculations.  Gambit  was  developed  at  the  California  Institute  of  Technology  and  provides 
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several  equilibrium  calculation  algorithms  for  normal  and  extensive  form  games.  The 
Enumerated  Mixed  (EnumMix)  algorithm  was  used  for  this  study,  since  it  performs  the  same 
calculations  as  described  above  (McKelvey,  1997:  WWWeb). 


2.8.1  Strategy  Representation 

A  best  strategy  response  profile  is  an  expression  of  probability  for  each  action  available 
to  a  player.  Each  action  is  assigned  a  probability  that  the  player  will  play  that  action  at  any  given 
time.  Thus,  the  equilibrium  strategy  is  the  set  of  probabilities  for  every  action  that  maximizes 
the  player’s  payoff. 


Table  2-6  Strategy  Representation 


_ Defender  Strategy  Profile _ Attacker  Strategy  Profile _ 

P(A1)  =  L  Probability  of  Defender  P(fU)  =  S  Probability  of  Attacker  playing 

_ playing  action  A1 _ action  III _ _ 

P(A2)  =  M  Probability  of  Defender  P(II2)  =  T  Probability  of  Attacker  playing 

_ playing  action  A2 _ action  IT2 _ 

P(A3)  =  1-L-M  Probability  of  Defender  P(n3)=l-S-T  Probability  of  Attacker  playing 

_ playing  action  A3 _ action  113 _ 


Table  2-6  shows  the  Defender’s  mixed  strategy:  (L,  M,  1-L-M)  and  the  Attacker’s  mixed 
strategy  is  (S,  T,  1-S-T).  Determining  the  equilibrium  strategy  involves  finding  values  for  L  and 
M  and  S  and  T  so  that  each  player’s  payoff  is  maximized  given  their  opponent’s  mixed  strategy. 
The  representation  in  Table  2-6  will  hold  for  the  remainder  of  the  report. 


2.8.2  Forming  a  Best  Response  Strategy  Profile  and  Determining  Equilibrium 

The  best  response  methodology  will  now  be  illustrated  using  one  of  the  four  specific 
games  of  this  study.  The  game  GSs  (Attacker  and  Defender  type  is  Social),  which  has  a  mixed 
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strategy  equilibrium,  will  provide  the  example.  Table  2-7  shows  this  game’s  normal  form,  with 
expected  payoffs.  Its  important  to  note  that  the  Defender’s  success  probability  determines  how 
much  information  is  protected,  thus: 

Expected  Defender  Payoff  =  [(Probability  of  Action  Success  *  Actual  Loss)  -  Actual  Loss]  *  (-1) 

The  Attacker’s  expected  payoff  is  more  straightforward  since  it  simply  indicates  how  much 

payoff  the  Attacker  can  expect  to  receive,  thus  the  expected  payoff  for  the  Attacker  is: 

Expected  Attacker  Payoff  =  Probability  of  Action  Success  *  Actual  Payoff 

Table  2-7  Normal  Form  for  Game  Gss 


Defender 

Attacker 

A1 

A2 

A3 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Probability 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

0.7 

-70 

-21 

0.75 

-70 

-17.5 

0.55 

-70 

-31.5 

m 

03 

70 

21 

0.25 

70 

17.5 

0.45 

70 

31.5 

0.5 

-50 

-25 

0.4 

-50 

-30 

0.6 

-50 

-20 

172 

0.5 

40 

20 

0.6 

40 

24 

0.4 

40 

16 

0.5 

-25 

-12.5 

0.5 

-25 

-12.5 

0.63 

-25 

-9.25 

IB 

0.5 

55 

27.5 

0.5 

55 

27.5 

0.27 

55 

15.125 

The  next  step  in  calculating  the  best  response  strategy  profiles  is  to  eliminate  dominated 
strategies.  Recall  that  a  strongly  dominated  strategy  is  an  action  that  never  yields  a  better  payoff 
than  any  other  action.  Using  expected  payoffs,  Table  2-7  shows  that  112  and  A1  are  strongly 
dominated.  All  other  actions  are  a  best  response  in  at  least  one  case.  Thus  the  support  for  this 
game  is  {Ill,  113}  X  {A2,  A3};  this  notation  indicates  that  play  will  occur  stochastically  among 
the  four  cells  outlined  in  Table  2-7. 

Finally,  the  best  response  strategy  profile  (a  probability  distribution)  can  be  calculated. 
Because  fI2  and  A1  are  not  in  the  support,  their  probability  of  being  played  is  zero,  thus  L  and  T 
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=  0.  To  determine  P(A2),  P(A3),  P(ni),  and  P(FI3),  the  following  four  equations  are  solved: 

P(ni)  +  P(n3)  =  1 
P(A2)  +  P(A3)  =  1 

-17.5  x  P(ni)  -  12.5  x  P(ri3)  =  -31.5  x  P(ni)  -  9.25  x  P(n3) 

17.5  x  P(A2)  +  31.5  x  P(A3)  =  27.5  x  P(A2)  +  15.125  x  P(A3) 

P(ni)  =  0.18  ::P(n3)  =  0.82 
P(A2)  =  0.63  ::  P(A3)  =  0.37 

Therefore  the  best  response  strategy  profile,  at  equilibrium,  for  the  Attacker  is  (0.18,  0.0,  0.82). 
Likewise,  the  best  response  strategy  profile  for  the  Defender  is  (0.0,  0.63,  0.37).  The  Gambit 
program  produced  identical  results.  To  review  what  this  really  means,  the  Attacker’s  best 
response  strategy  is  to  play  ni  (Social  Attack)  18%  of  the  time  and  113  (Node  Attack)  82%  of 
the  time.  Also  recall  that  this  ratio  indicates  both  the  Attacker’s  best  guess  about  the  Defender’s 
type  and  his/her  best  response  to  the  hypothesized  Defender  type.  Equilibria  for  the  other  games 
used  in  this  study  will  be  shown  where  needed. 

2.9  Game  Theoiy  Experiments 

Now  that  the  IW  Model  is  fully  defined,  it  must  be  tested  and  evaluated.  This  section 
summarizes  several  game  theoretic  experiments  in  order  to  provide  a  foundation  for  this  study’s 
methodology  for  testing  and  evaluating  the  IW  Model.  In  particular,  what  aspects  of  the  model 
should  tested?  What  are  the  best  methods  for  accomplishing  these  tests?  And  what  other 
considerations  must  be  accounted  for  when  testing  the  model?  Although  game  theory  is  most 
often  used  as  tool  to  analyze  economic  or  social  situations  and  not  the  model  itself  (Gibbons, 
1997:  45),  there  are  several  examples  of  experiments  that  validate  and  refine  game  models  or 
aspects  of  a  particular  game  model.  These  final  examples  provide  the  primary  basis  for  this 
study. 
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2.9.1  Equilibrium  Experiments 


Equilibrium  is  a  central  concept  in  game  theory;  a  given  model’s  predictive  power  rests 
in  its  equilibrium.  However,  in  some  classes  of  repeated  games  that  involve  signaling,  equilibria, 
as  derived  from  the  model,  are  unintuitive  to  people  given  the  context  of  the  game.  Brandts  and 
Holt  performed  an  experiment  to  study  game  play  in  such  situations.  Their  experimental 
manipulations  involved  the  information  that  players  had  about  their  opponent’s  type  and  the 
payoff  distributions  (some  treatments  had  payoffs  that  varied  dramatically  while  others  had 
payoffs  closer  together).  They  found  that  people  generally  do  not  play  unintuitive  equilibrium 
strategies,  although  they  would  benefit  by  doing  so;  this  occurs  even  if  the  equilibrium  strategy 
was  suggested  to  the  players.  Brandts  and  Holt  refined  their  game  model  and  predictions 
continuously  throughout  the  experiments;  in  particular,  they  provided  additional  instructions  to 
focus  the  subject’s  attention  on  the  predicted  equilibrium  strategy  (Brandts  and  Holt,  1992:  1350- 
1366). 

Ochs  performed  a  study  to  test  the  mixed  strategy  predictions  of  three  different 
equilibrium  models.  Specifically,  he  compared  the  predictions  of  Nash  equilibrium,  a  quantal 
equilibrium  model  and  an  adaptive  learning  model.  His  experimental  treatments  involved  the 
manipulation  of  the  games’  payoff  functions  to  produce  either  highly  symmetric  or  asymmetric 
payoffs;  specifically,  one  treatment’s  game  placed  both  players  best  payoff  in  the  same  cell,  the 
second  treatment  placed  each  player’s  best  payoff  in  different  cells  and  the  final  treatment  had 
zero-sum  payoffs.  He  then  compared  the  expected  payoff  distributions  to  the  distributions 
actually  realized  in  the  experiments.  He  found  that  Nash  equilibrium  predictions  worked  best 
with  the  symmetric  and  zero-sum  games  while  the  adaptive  learning  model  better  fit  the 
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asymmetric  model  (Ochs,  1995:  202-217). 

Bloomfield  performed  a  similar  study  to  compare  the  predictions  of  adaptive  learning  and 
Nash  equilibrium  models  when  payoffs  are  publicly  disclosed,  thus  his  treatment  variable  was 
whether  the  opponent’s  payoffs  were  revealed  or  not.  He  found  that  adaptive  learning  provided 
better  predictions  when  the  payoffs  were  not  revealed.  Conversely,  play  converged  to  Nash 
equilibrium  predictions  when  payoffs  were  revealed.  This  study  reinforces  two  key  elements  of 
general  equilibrium  theory.  First,  providing  payoff  information  allows  the  players  to  more 
strategically  calculate  payoffs  and  equilibria  strategy.  Second,  payoff  information  causes  the 
players  to  act  less  predictably,  since  unpredictability  is  a  key  determinant  in  calculating  mixed 
strategy  mixed  equilibrium  this  result  increases  the  predictive  power  of  mixed  strategy  Nash 
equilibria  (Bloomfield,  1994:  411-436). 

These  studies  demonstrate  the  importance  of  and  methodology  for  manipulating  and 
testing  equilibrium  play.  As  stated  previously,  equilibrium  is  the  key  prediction  of  a  game  model 
and  determining  if  people  play  equilibrium  strategies  is  an  important  step  when  evaluating  a  new 
game  theory  model.  These  studies  support  this  conclusion  and  show  how  to  test  equilibrium 
play. 

2.9.2  Equilibrium  Support  Tools 

Although  equilibrium  is  the  most  important  prediction  of  a  game  model,  its  more 
important  that  the  game  model  allows  the  development  and  testing  of  hypotheses  about  people’s 
behavior  in  the  actual  social  situation  underlying  the  game  model  (Gibbons,  1997:  1).  In  this 
study,  the  IW  Model  should  allow  an  analysis  of  information  warfare  behavior.  In  particular,  do 
information  warfare  technologies  improve  an  individual’s  performance  in  information  warfare 
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operations?  These  IW  technologies  (described  shortly)  are  analogous  to  the  game  theory 
concepts  of  fictitious  play  and  pattern  recognition. 

Fictitious  play  is  a  learning  and  behavior  model  in  which  player’s  hold  beliefs  about  their 
opponent’s  intentions  in  order  to  form  behavior  rules.  These  behavior  rules  then  guide  their  own 
game  play.  Each  player’s  set  of  beliefs  and  behavior  rules  are  refined  as  the  game  progresses 
and  more  information  is  obtained.  The  basis  for  this  refinement  is  the  history  of  the  game,  i.e. 
the  moves  that  each  player  has  made  through  the  course  of  the  game.  Players  assess  the  game’s 
history  in  order  to  determine  what  moves  they  could  have  made  in  order  to  realize  better  payoffs. 
They  then  use  this  assessment  to  refine  their  behavior  rules.  Fudenberg  and  Kreps  show  that 
fictitious  play  converges  to  mixed  strategy  equilibrium  without  the  demand  for  rigorous 
probabilistic  equilibrium  calculations  by  the  players.  So,  tools  that  support  fictitious  play 
reduces  the  players’  computational  burden,  perhaps  improving  game  play  (Jordan,  1993:  368- 
386;  Fudenberg  and  Kreps,  1993:  320-367). 

Sonsino,  Jordan,  and  Fudenberg  and  Kreps  show  that  the  ability  to  recall  and  analyze  the 
history  of  the  game  can  reduce  the  players’  computational  burden  and  lead  to  quicker,  tighter 
convergence  to  mixed  strategy  equilibrium.  However,  players  will  have  difficulty  remembering 
and  analyzing  histories  in  repeated  games  (due  to  the  number  of  game  repetitions)  (Bloomfield, 
1994:  411-436).  Thus,  providing  players  with  a  tool  that  tracks  the  history  of  the  game  and 
provides  some  pattern  analysis  capability  could  improve  convergence  to  mixed  strategy 
equilibrium. 

The  learning  tools  suggested  by  the  above  studies  parallel  actual  technologies  used  during 
information  warfare.  On  the  defensive  side,  network  intrusion  detection  devices,  network 
monitoring  devices,  and  system  configuration  audits  essentially  provide  game  histories.  They 
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also  give  the  defender  more  information  about  their  employed  strategies,  thus  allowing  more 
educated  strategy  refinement.  On  the  offensive  side  there  are  less  analogous  technologies, 
however,  network  mapping  tools,  penetration  analyses,  and  social  engineering  (e.g.  posing  as  a 
systems  administrator  and  polling  users  about  their  network)  contribute  to  an  attackers  ability  to 
learn  about  and  refine  their  strategy  selection  (Management  Analytics,  1995:  WWWeb). 

2.10  Research  Objectives  and  Hypotheses 

This  study’s  purpose  is  to  test  the  information  warfare  game  model,  a  variation  of  the 
repeated  game  with  incomplete  information  model  described  earlier.  As  pointed  out  previously, 
this  class  of  games  seems  to  capture  several  elements  of  information  warfare.  As  alluded  to  in 
preceding  discussions,  a  game  model’s  equilibrium  is  its  most  important  component  -  without  an 
accurate  equilibrium,  the  game  model  possesses  little  predictive  power.  Section  2.10.1  shows 
how  equilibrium  play  in  the  IW  Model  will  be  tested.  An  equally  important  question  regards 
how  people  “play”  the  information  warfare  game.  Specifically,  are  people  learning  about  the 
strategies  and  their  opponent  as  the  game  progresses?  The  research  studies  discussed  previously 
indicate  that  people  reach  equilibrium  more  quickly  with  fictitious  play  and  pattern  recognition 
tools.  Since  these  tools  are  analogous  to  actual  IW  technologies,  determining  if  the  learning 
tools  improve  game  play  will  also  shed  light  on  the  effectiveness  of  IW  technologies.  In  order  to 
answer  these  questions,  a  fully  randomized  experimental  design  will  be  conducted,  manipulating 
the  game  type  (pure  strategy  and  mixed  strategy),  role  (attacker  or  defender),  and  the  presence  on 
information. 

2.10.1  Measuring  Equilibrium 

To  give  a  general  indication  of  the  predictive  accuracy  of  the  IW  Model,  the  number  of  rounds  to 
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reach  equilibrium  (NORRE)  for  each  subject  will  be  measured  and  reported.  Lower  NORRE 
values  indicate  that  a  player  has  reached  equilibrium  quickly,  demonstrating  that  they  are  playing 
in  accordance  with  the  IW  Model's  predictions.  A  more  detailed  description  of  the  NORRE 
metric  is  provided  in  Chapter  3. 

2.10.2  Impact  of  Information  Warfare  Experience 

People  with  information  warfare  experience  should  converge  to  equilibrium  more  quickly 
than  those  without  prior  experience.  Persons  with  IW  experience  will  be  more  familiar  and  more 
comfortable  with  the  IW  strategies  and  terminology  presented  during  the  experiment.  Their 
experience  should  result  in  their  NORRE  values  being  lower  than  those  without.  Hypothesis  1 
tests  this  conclusion: 

Hypothesis  1:  Information  warfare  experience  will  cause  a  faster  convergence  to  the 

mixed  strategy  equilibria  of  games  Gss  and  Gns. 

2.10.3  Pure  Strategy  Play 

A  pure  strategy  is  one  in  which  a  single  action  is  the  best  response;  thus  only  one  action 
is  ever  played.  In  games  with  pure  strategy  equilibrium,  all  actions  but  the  one  being  played  are 
dominated  (either  strongly  or  weakly).  Game  Gni,  Attacker  type  Infrastructure  and  Defender  type 
Node,  provides  the  pure  strategy  equilibrium  game  for  the  experiment.  Table  2-8  shows  its 
Normal  Form. 

The  NORRE  score  for  the  pure  strategy  equilibrium  game  serves  two  purposes.  First,  if 
players  do  not  play  the  pure  strategy  equilibrium,  it  will  indicate  a  possible  flaw  in  the  IW  game 
model.  This  is  because  the  pure  strategy  equilibrium  is  simpler  than  mixed  strategy  equilibrium 
since  it  requires  players  to  only  recognize  one  best  strategy.  Second,  the  pure  strategy  game  will 
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provide  a  basic  measure  of  each  subject’s  ability  to  recognize  game  theoretic  equilibria.  For  this 
study,  this  ability  will  be  referred  to  as  game  theoretic  rationality,  or  rationality  for  short.  The 
rationality  measure  provided  by  the  pure  strategy  equilibrium  allows  a  multitude  of  personal 
characteristics  (logical  reasoning,  probabilistic  reasoning,  concentration,  etc.)  that  lead  to  better 
game  performance  to  be  captured  in  one  measurement.  Better  game  performance  in  the  pure 
strategy  game  should  lead  directly  to  better  performance  in  the  mixed  strategy  game  due  to  the 
factors  mentioned  above.  The  full  use  of  game  theoretic  rationality  will  be  described  in  Chapter 
3. 


Table  2-8  Normal  Form  for  Game  Gni 


Defender 

Attacker 

Al 

A2 

A3 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Probability 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

0.5 

-50 

-25 

0.25 

-50 

-37.5 

0.6 

-50 

-20 

727 

0.5 

25 

12.5 

0.75 

25 

18.75 

0.4 

25 

10 

0.75 

-25 

-6.25 

0.5 

-25 

-12.5 

0.67 

-25 

-8.25 

172 

0.25 

75 

18.75 

0.5 

75 

37.5 

0.33 

75 

24.75 

0.75 

-75 

-18.75 

0.85 

-75 

-11.25 

0.55 

-75 

-33.75 

IB 

0.25 

50 

12.5 

0.15 

50 

7.5 

0.45 

50 

22.5 

Equilibrium  play  in  the  pure  strategy  game  GNi  motivates  Measure  1  and  Flypothesis  2: 

Measure  1:  The  number  of  rounds  to  reach  equilibrium  in  the  pure  strategy  game 
Gni  (equilibrium  strategies  -  (Al,  112))  as  indicated  in  Table  2-8  will  be  measured 
and  reported. 

Hypothesis  2:  Lower  NORRE  scores  in  the  pure  strategy  game  Gni  will  correlate 
with  lower  NORRE  scores  in  the  mixed  strategy  games. 
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2.10.4  Mixed  Strategy  Play 


Predicting  mixed  strategy  play  is  critical  for  the  utility  of  the  IW  Model  (as  discussed  in 
Section  2.8).  The  mixed  strategy  games  will  be  used  to  generate  the  target  variables  of  the  study. 
Specifically,  the  number  of  rounds  to  reach  equilibrium  in  the  mixed  strategy  games  will  be  the 
focus  of  determining  the  effect  of  experimental  manipulations.  Two  mixed  games  are  necessary 
to  ensure  that  observed  game  play  is  not  due  to  unexpected  characteristics  of  the  actual  game. 
Thus,  the  use  of  two  mixed  strategy  games  increases  the  generalization  of  the  IW  Model.  If 
subjects  reach  equilibrium  more  quickly  in  one  game  than  in  the  other,  it  indicates  an  underlying 
problem  with  the  IW  Model  (as  discussed  in  previous  sections). 


Table  2-9  Normal  Form  for  Game  Gns 


Defender 

Attacker 

A1 

A2 

A3 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Success 

Actual 

Expect 

Probability 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

Prob. 

Payoff 

Payoff 

0.7 

-50 

-15 

0.75 

-50 

-12.5 

0.65 

-50 

-17.5 

m 

0.3 

70 

21 

0.25 

70 

17.5 

0.35 

70 

24.5 

0.5 

-35 

-17.5 

0.4 

-35 

-21 

0.55 

-35 

-15.75 

172 

0.5 

40 

20 

0.6 

40 

24 

0.45 

40 

18 

0.75 

-75 

-18.75 

0.6 

-75 

-30 

0.65 

'  -75 

-26.25 

773 

0.25 

50 

12.5 

0.4 

50 

20 

0.35 

50 

17.5 

Measure  2:  The  number  of  subjects  that  converge  to  the  mixed  strategy  equilibrium 
when  playing  game  Gss  as  indicated  in  Table  2-7:  Attacker  strategy  profile  =  (0.18, 
0.0, 0.82),  Defender  strategy  profile  =  (0.0, 0.63, 0.37). 

Measure  3:  The  number  of  subjects  that  converge  to  the  mixed  strategy  equilibrium 
when  playing  game  Gns  as  indicated  in  Table  2-9:  Attacker  strategy  profile  =  (0.58, 
0.42,  0.0),  Defender  strategy  profile  =  (0.86, 0.14,  0.0). 
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2.10.2  Learning  Processes  and  Tools 

Section  2.9.2  suggests  that  tools  that  support  learning  processes,  such  as  fictitious  play, 
could  improve  mixed  strategy  convergence.  The  question  here  is  if  equilibrium  convergence 
improves  when  players  can  reference  and  analyze  the  history  of  the  game.  The  following 
hypotheses  address  these  issues: 

Hypothesis  3.a:  Learning  tools  will  cause  faster  convergence  to  the  mixed  strategy 
equilibrium  of  game  Gss  shown  in  table  2-7. 

Hypothesis  3.b:  Learning  tools  will  cause  faster  convergence  to  the  mixed  strategy 
equilibrium  of  game  Gns  shown  in  table  2-9. 

2.11  Summary 

This  chapter  laid  the  foundation  for  the  information  warfare  game  model  and  then 
developed  the  IW  Model  itself.  Then,  research  that  supports  this  study’s  research  questions  and 
methodology  was  presented.  Finally,  this  study’s  research  questions  were  described.  With  these 
elements  in  place,  Chapter  3  will  discuss  how  the  research  questions  were  addressed  with  an 
experiment. 
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3.  Methodology 


This  chapter  describes  the  research  methodology  used  to  investigate  the  measures  and 
hypotheses  proposed  in  Chapter  2.  The  first  two  sections  of  this  chapter  describe  the  overall 
experimental  design  for  the  study.  The  third  section  discusses  the  study’s  constructs  and 
measures.  The  fourth  section  describes  the  methods  used  to  evaluate  the  experiment’s  results 
and  the  hypotheses. 

3.1  Experimental  Design 

A  between  subjects  Analysis  of  Covariance  (ANCOVA)  design  was  used  for  this 


experiment.  The  ANCOVA  was  used  to  determine  the  effects  and  interactions  of  the 
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experimental  manipulations  and  is  explained  in  detail  later  in  this  chapter.  Figure  3-1  depicts  the 
experiment’s  design.  The  covariate,  rationality,  was  measured  for  all  24  subjects  in  the  first 
treatment  condition.  Likewise,  information  warfare  experience  was  measured  for  all  24  subjects 
with  a  self-reported  Yes  or  No  question  (i.e.  yes  they  have  IW  experience  or  no  they  do  not). 
The  next  treatment  conditions  involved  the  effect  of  learning  tools  on  equilibrium  convergence. 
Two  different  mixed  strategy  games  helped  ensure  that  no  unknown  characteristics  of  the  game 
itself  caused  the  observed  equilibrium  behavior.  The  treatment  conditions  are  described  in  more 
detail  later  in  the  chapter. 

3.1.1  Subject  Assignment 

Experimental  subjects  were  graduate  students  at  the  Air  Force  Institute  of  Technology 
(AFIT).  All  subjects  were  active  duty  US  Air  Force  officers.  All  24  subjects  participated  in  the 
first  treatment  condition,  PI,  in  order  to  measure  the  rationality  covariate.  Then,  six  subjects 
were  randomly  assigned  to  each  of  the  four  mixed  strategy  treatment  conditions.  Thus  all 
subjects  participated  in  two  sessions,  the  first  being  PI  and  the  second  being  one  of  the  mixed 
strategy  conditions  (Ml,  M2,  M3,  or  M4). 

Many  subjects  were  information  technology  managers,  software  developers,  or  had  taken 
information  courses.  Chapter  2  hypothesized  that  prior  experience  with  information  warfare 
should  enhance  game  play.  Therefore,  subjects  were  asked  whether  they  had  information 
warfare  experience.  The  subjects  were  provided  a  definition  of  IW  experience  and  answered 
“yes”  if  they  felt  that  they  fit  the  definition  and  “no”  if  they  did  not. 

3.1.2  Experimental  Methodology  Overview 

The  experiment  was  conducted  in  an  AFIT  computer  lab  using  software  developed  for 
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this  study.  The  author  used  Microsoft  Visual  Basic  and  Microsoft  Access  to  develop  the 
experimental  software.  The  software  features  a  graphical  user  interface,  with  standard  Microsoft 
Windows  features;  since  all  Air  Force  officers  at  AFIT  receive  training  in  using  Microsoft  Office 
products,  the  software  presented  no  initial  learning  problems.  A  database  developed  in 
Microsoft  Access  contained  the  information  on  the  actual  games  being  played  (i.e.  payoff  tables) 
and  logged  all  actions  played.  In  treatment  conditions  M2  and  M4,  the  experimental  software 
provided  the  tools  to  support  learning  (described  more  thoroughly  in  the  next  section).  A  backup 
database  was  maintained  in  case  the  primary  became  corrupted  during  the  course  of  the 
experiment. 

As  mentioned  previously,  experimental  sessions  were  conducted  in  groups  of  six 
subjects,  each  subject  worked  on  a  separate  computer.  Nothing  besides  the  experimental 
software  was  allowed  while  the  experiment  was  in  progress.  The  use  of  calculators,  other  SW 
programs,  paper,  etc.  was  prohibited.  Thus,  there  were  8  experimental  sessions,  with  all  subjects 
participating  in  treatment  PI  and  then  randomly  assigned  to  one  of  the  mixed  strategy  conditions. 
Because  the  sessions  were  conducted  in  an  open,  classroom  environment,  a  critical  factor  in  all 
sessions  was  to  prevent  players  from  learning  the  identity  of  their  opponent.  Subjects  who  know 
the  identity  of  their  opponent  could  play  differently  than  they  otherwise  would  because  of 
interpersonal  relationships.  Steps  to  maintain  opponent  anonymity  are  outlined  shortly. 

Each  session  began  with  the  experimenter  briefing  the  subjects  on  the  purpose  of  the 
experiment  and  the  basic  workings  of  the  software.  Then,  the  experimenter  answered  any 
questions.  When  the  question  period  was  complete,  the  experiment  commenced.  The  key  to 
maintaining  opponent  anonymity  was  to  ensure  that  no  subject  stops  game  play  while  the  other 
subjects  continue  to  play;  if  a  subject  were  to  stop,  their  opponent  would  notice  the  delay  in 
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game  play  and  surmise  their  opponent’s  identity.  Thus,  if  any  subject  stopped  game  play  for  a 
moment,  all  subjects  were  asked  to  pause.  The  second  set  of  sessions  also  involved  a  briefing  to 
describe  the  learning  tools  in  conditions  M2  and  M4. 

Subjects  were  randomly  assigned  the  role  of  defender  or  attacker  and  they  maintained 
this  role  throughout  the  treatment.  However,  they  were  again  randomly  assigned  a  role  during 
the  mixed  strategy  treatments.  Thus,  subjects  could  have  been  a  defender  once,  twice,  or  never. 
Each  defender  played  every  attacker  in  each  treatment.  So,  each  experimental  session  actually 
involved  each  subject  playing  three  rounds  of  the  same  game.  This  configuration  allowed  nine 
measurements  for  each  session  for  a  total  of  72  data  points.  Because  the  games  were  so  simple, 
learning  effects  after  round  1  were  minimal  and  constant  across  all  subjects. 

Subjects  played  40  game  repetitions  during  all  sessions  and  all  rounds.  Recall  from 
chapter  2  that  Nash  equilibria  are  strategically  stable,  thus  once  they  are  reached  players  have  no 
incentive  to  deviate.  However,  player’s  may  not  immediately  recognize  the  best  mixed  strategy, 
thus  several  repetitions  may  reflect  their  strategy  refinement.  Forty  repetitions  were  sufficient  to 
recognize  equilibrium  play  and  should  prevent  subject  fatigue  or  boredom  (Bloomfield,  1997: 
411-436).  Players  were  not  told  the  number  of  repetitions;  thus  they  were  playing  with  an 
infinite  horizon.  The  equilibria  calculated  for  this  study  would  not  be  valid  for  a  finite  horizon 
game,  such  as  when  players  are  told  the  numbers  of  repetitions.  Finite  horizons  typically  have 
different  equilibria  than  infinite  horizon  games.  Additionally,  infinite  horizons  involve  equilibria 
that  maximize  immediate  and  long-term  payoff  (Myerson,  1991:  308-309). 
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3.2  Treatment  Conditions 


Chapter  2  described  the  specific  games  that  were  used  in  the  experiment.  Recall  from 
section  2.10  that  manipulating  payoffs  and  success  probabilities  produced  the  games  with  the 
required  equilibrium  types  (i.e.  one  pure  strategy  equilibria  and  two  mixed  strategy  equilibrium). 
Thus,  the  actual  games  are  realizations  of  the  IW  Model. 

3.2.1  Equilibrium  Types 

Treatment  condition  PI  involved  the  pure  strategy  game  Gni-  This  game  is  the  simplest 
because  its  equilibrium  strategy  involves  the  play  of  only  one  strategy.  Thus,  when  subjects 
reach  equilibrium,  they  (both  the  attackers  and  defenders)  will  play  only  the  singular  equilibrium 
strategy.  Condition  PI  provided  both  Measurement  1  and  the  rationality  covariate. 

Treatment  conditions  Ml  and  M2  involved  the  mixed  strategy  game  Gss-  This  game  is 
more  complex  than  the  pure  strategy  game  because  it  requires  players  to  recognize  the  best 
combination  of  strategies  and  the  best  ratio  to  play  them  in.  When  subjects  reach  equilibrium, 
the  observed  frequency  of  actions  played  should  match  the  equilibrium  ratio  predicted  by  the 
model  (see  section  2.10).  Conditions  M3  and  M4  used  the  mixed  strategy  game  Gns-  This  game 
simply  has  different  payoffs  for  each  player  than  game  Gss-  Conditions  Ml  and  M3  do  not 
involve  learning  tools,  providing  the  control  for  learning  tools  and  measurements  two  and  three. 

3.2.2  Equilibrium  Support/Learning  Tools 

As  described  in  Chapter  2,  learning  tools  consisted  of  devices  that  support  pattern 
recognition  and  player  recall.  Thus  conditions  M2  and  M4  provided  players  with  two  learning 
aids  to  support  the  fictitious  play  model  described  in  section  2.10.5.  The  first  learning  tools 
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records  and  displays  all  payoffs  that  the  player  has  received  thus  far.  Additionally,  it  calculates 
the  average  payoff  from  the  current  strategy;  thus  players  were  provided  with  an  approximation 
of  their  expected  payoffs. 

Second,  players  were  provided  with  a  direct  support  for  the  fictitious  learning  model  -  a 
game  history.  The  game  software  listed  the  strategy  used  in  each  turn  and  the  payoff  received 
for  that  move.  Players  were  able  to  analyze  their  moves  and  payoffs  for  the  entire  course  of  the 
game  —  learning  which  moves  were  more  effective.  Thus,  they  should  have  been  better  equipped 
to  determine  the  best  mix  of  strategies. 

These  tools  support  both  general  learning  and  specifically  support  the  fictitious  play 
model.  As  mentioned  in  chapter  2,  these  tools  should  result  in  a  faster  and  tighter  convergence 
to  equilibrium  play.  The  learning  tools  treatment  conditions  (M2  and  M4)  tested  hypotheses  3. a 
and  3.b,  respectively. 

3.3  Constructs  and  Measures 

Recall  from  chapter  2  that  the  overall  point  of  this  study  is  to  determine  the  effectiveness  and 
accuracy  of  the  IW  Model.  The  power  of  a  game  theoretic  model  lies  in  its  prediction  of 
equilibrium  behavior.  Thus,  the  primary  purpose  of  the  experiment  is  to  measure  equilibrium 
play.  The  following  subsections  describe  equilibrium  convergence  and  the  use  of  covariates. 

3.3.1  Equilibrium  Convergence 

Equilibrium  play  is  attained  when  subjects  consistently  play  the  strategy  profile  predicted 
by  the  IW  Model  as  shown  in  section  2.9.  Subjects  will  initially  play  by  trial  and  error.  As  more 
repetitions  of  the  game  are  played,  they  should  be  able  to  estimate  the  expected  value  of  each 
strategy.  This  expected  value  then  provides  the  basis  for  a  pure  or  mixed  strategy.  Since 
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equilibria  are  strategically  stable,  players  cannot  benefit  by  deviating.  Specifically,  if  players 
deviate  from  the  equilibrium  strategy,  they  will  see  a  rapid  decrease  in  their  payoffs.  Thus  game 
play  was  characterized  by  a  period  of  random  strategy  play  followed  by  a  convergence  to  the 
equilibrium  strategy. 

The  number  of  rounds  to  reach  equilibrium  (NORRE)  is  the  primary  measure  of 
equilibrium  convergence.  Thus,  NORRE  is  the  dependent  variable  in  all  treatment  conditions. 
NORRE  was  measured  for  each  subject.  A  scatter  plot  helps  show  what  NORRE  actually 
represents.  The  scatter  plot’s  X-axis  shows  the  turn  and  the  Y-axis  shows  the  action  played.  The 
plot  can  then  be  visually  examined  to  determine  the  turn  at  which  play  has  reached  equilibrium. 
Figure  3-2  shows  a  fictitious  20  round  session  of  the  defender  playing  game  Gss-  The 
Defender’s  equilibrium  for  this  game  is  to  play  action  2  (A2)  with  probability  0.67  and  action  3 
(A3)  with  probability  0.33.  This  ratio  exists  in  Figure  3-2  following  turn  9;  thus  the  NORRE 
value  for  this  session  is  9. 


Fieure  3-2  Eauilibrium  Calculation  Plot 
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3.3.2  Game  Theoretic  Rationality  and  Experience 

Game  theoretic  rationality  captures  the  ability  of  subjects  to  recognize  and  play  game 
theory  equilibria.  The  ability  to  recognize  game  theory  equilibria  depends  on  many 
characteristics  such  as  mathematical  ability,  attentiveness,  and  the  ability  to  ignore  extraneous 
information.  Rather  than  attempting  to  capture  these  various  elements,  game  theoretic  rationality 
was  measured  by  using  the  number  of  turns  to  reach  equilibrium  measure  described  above. 
Specifically,  treatment  condition  PI  provided  the  basic  rationality  measure  for  the  subsequent 
M1-M4  treatments. 

High  game  theoretic  rationality  should  allow  a  player  to  quickly  converge  to  equilibrium. 
Thus,  a  subject  with  high  game  theoretic  rationality  should  reach  equilibrium  in  fewer  turns  than 
a  subject  with  lower  game  theoretic  rationality.  Therefore,  the  NORRE  measures  from  treatment 
PI  provided  the  rationality  covariate  used  in  the  analysis  of  later  treatments.  Specifically,  lower 
NORRE  values  should  equate  to  higher  game  theoretic  rationality. 

In  treatments  M1-M4  subjects  reached  equilibrium  at  different  turns.  The  rationality 
covariate  allowed  the  variation  due  to  innate  ability  to  be  removed  from  the  overall  variation  in 
the  number  of  turns  to  reach  equilibrium.  Thus,  the  impact  of  the  learning  tools  became  clearer 
as  the  variation  due  to  rationality  was  removed. 

As  discussed  previously,  information  warfare  experience  could  result  in  bias. 
Specifically,  information  warfare  experience  could  cause  faster  equilibrium  convergence  because 
subjects  can  apply  their  experience  to  the  IW  Model.  As  mentioned  in  section  2.1 1,  the  impact 
of  IW  experience  was  tested  in  Hypothesis  1  and  was  also  used  as  a  covariate. 
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3.4  Hypothesis  Assessment  and  Statistical  Analysis 

The  number  of  turns  to  reach  equilibrium  (NORRE)  is  the  primary  measurement  of  this  study. 
NORRE  provides  the  basis  for  determining  if  players  have  reached  equilibrium  and  then 
comparing  the  time  to  reach  equilibrium  across  subjects  and  treatment  conditions.  The  following 
subsections  describe  the  methods  used  to  make  these  assessments.  The  mixed  game  NORRE 
score  is  the  dependent  variable  in  all  statistical  analyses. 

3.4.1  Determining  the  Impact  of  1W  Experience  and  Learning  Tools 

Figure  3-3  shows  the  full  2  X  2  X  2  factorial  design  of  the  ANCOVA.  The  fixed  factors 
include  learning  tools  (presence  or  absence),  pure  game  role  (defender  or  attacker),  and  mixed 
game  role  (defender  or  attacker).  The  mixed  game  type  (Gss  and  Gns)  is  not  shown  as  a  separate 
factor,  but  will  be  tested  to  determine  its  effect.  If  a  significant  main  or  interactive  effect  due  to 
game  type  is  identified,  game  type  will  be  added  to  the  analysis,  effectively  producing  a  2  X  2  X 


Figure  3-3  ANCOVA  Factorial  Design.  Each  of  the  above  Defender 
matrices  is  repeated  for  the  two  mixed  strategy  games.  (Pure) 


Attacker 

tPuret 
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2X2  design.  Each  subject’s  pure  strategy  game  NORRE  scores  was  averaged  and  included  as  a 
covariate  in  the  ANCOVA.  IW  experience  was  the  second  covariate,  as  already  explained.  IW 
Experience,  Tools  use,  and  the  role  (i.e.  defender  or  attacker)  terms  are  all  dummy/indicator 
variables  coded  as  a  zero  (0)  or  one  (1). 

The  general  significance  of  each  term  (including  the  IW  Experience  covariate)  was 
assessed  by  using  an  F-statistic.  The  F-statistic  is  the  ratio  of  variation  between  treatment  groups 
(as  shown  in  Figure  3-2)  to  the  variation  among  all  groups.  The  F-statistics  were  considered 
significant  (i.e.  the  alternative  hypothesis  that  a  meaningful  relationship  exists  between  the 
independent  variable  and  the  dependent  variable  is  accepted)  at  an  a  <  0.05.  This  level  of 
significance  indicates  a  5%  chance  of  falsely  rejecting  the  Null  hypothesis  that  no  meaningful 
relationship  exists  between  the  independent  and  dependent  variables  of  concern. 

If  a  meaningful  relationship  is  found  to  exist,  the  eta-squared  (eta2)  index  was  used  to 
assess  its  strength.  The  eta2  index  ranges  between  0.0  and  1 .0;  larger  values  indicate  a  stronger 
relationship  between  the  independent  and  dependent  variables.  So,  the  eta2  index  shows  the 
amount  of  variation  in  the  dependent  variable,  the  mixed  game  score,  attributable  to  the 
independent  variable  (such  as  tools,  defender,  etc.). 

Finally,  a  general  linear  regression  model  was  used  to  determine  the  direction  (positive  or 
negative)  of  the  independent  variables’  effects.  The  independent  variables’  sign  was  used  to 
judge  the  hypotheses.  Specifically,  pure  strategy  score,  IW  experience,  and  Tools  use  should  all 
have  negative  coefficients  according  to  hypotheses  1-3.  Finally,  the  squared  Pearson  correlation 
coefficient  (R2)  was  assessed  to  determine  the  overall  explanatory  power  of  the  regression 
model.  The  R2  is  the  ratio  of  explained  to  unexplained  variation,  ranging  between  0.0  and  1.0 
with  higher  values  indicating  more  explanatory  power. 
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3.5  Summary 


This  chapter  presented  the  overall  experimental  design  and  the  methodology  with  which 
the  design  will  be  implemented.  Then,  the  methods  for  data  collection  and  analysis  were 
presented.  Chapter  4  will  present  the  results  from  the  experiment  and  the  initial  analysis  of  these 
results. 
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4.  Analysis  of  Data 


4. 1  Introduction 

This  chapter  presents  an  assessment  of  experimental  manipulations,  reports  measurements,  and 
provides  an  analysis  of  collected  data.  Recall  from  Chapter  3  that  the  mixed  game  score  is  the 
dependent  variable  in  all  analyses  unless  otherwise  noted.  The  implications  of  this  data  in  terms 
of  the  experimental  hypotheses  are  addressed  in  Chapter  5. 


4.2  Equilibrium  Measures 

This  section  presents  two  measurements  of  overall  performance  in  the  pure  strategy  game  and 
the  mixed  strategy  games.  Overall  performance  is  measured  in  terms  of  the  number  of  rounds  to 
reach  equilibrium.  The  percentage  of  subjects  who  reach  equilibrium  indicates  the  percentage  of 
subjects  who  attained  equilibrium  in  at  least  one  round.  Both  measurements  are  shown  in  Table 
4-1. 


Table  4-1  Equilibrium  Measurements 


Game 

Percentage 

Attaining 

Equilibrium 

Mean  Score 

Pure  Strategy  (Gni) 

54.2% 

33.583 

Mixed  Strategy  (Gss) 

50% 

36.278 

Mixed  Strategy  (Gns) 

35.7% 

36.444 

These  measurements  show  that  a  slim  majority  of  subjects  reached  equilibrium  in  the  pure 
strategy  game  and  in  the  mixed  strategy  game  GSs-  Although  a  majority  of  subjects  did  not  reach 
equilibrium  in  the  mixed  strategy  game  GNs,  the  subjects  who  did  reach  equilibrium  reached  it 
more  quickly.  The  implications  of  these  findings  are  discussed  in  Chapter  5. 
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4.3  Mixed  Game  Analysis 


The  effect  of  the  specific  mixed  strategy  game  (Gss  or  Gns)  played  in  treatments  M1-M4 
on  the  mixed  game  score  was  assessed  using  the  full  ANCOVA  design,  with  the  Mixed  Game 
indicator  variable  left  in.  Although  it  cannot  be  proved  that  the  game  played  did  not  have  an 
effect  (this  would  be  an  attempt  to  prove  the  Null  hypothesis)  its  important  to  determine  if  the 
game  played  did  have  a  significant  effect.  If  it  does,  it  must  be  included  in  the  ANCOVA  and 
any  additional  statistical  analysis.  As  a  reference,  when  Mixed  =  0,  game  Gss  was  played, 
“Defl”  indicates  that  the  subject  was  a  defender  in  the  pure  strategy  game,  and  “Def2”  indicates 
that  the  subject  was  a  defender  in  the  mixed  strategy  game.  Table  4-2  presents  the  Mixed  Game 
ANCOVA  summary. 


Table  4-2  Mixed  Game  ANCOVA  Summary 


Source 

Degrees  Freedom 

F  Statistic 

Significance  (p) 

Pure  Average  Score 

1 

4.327 

0.042 

Mixed  Game 

1 

0.198 

Mixed  *  Tools 

1 

Mixed  *  Defl 

1 

2.546 

0.116 

Mixed  *  Def2 

1 

2.659 

Mixed  *  Tools  *  Defl 

1 

2.466 

0.122 

Mixed  *  Tools  *  Def2 

1 

1.593 

0.212 

Mixed  *  Defender  Both 

1 

3.945 

Mixed  *  Tools  *  Defender  Both 

1 

3.280 

0.076 

Overall  R2  =  0.419 

A  review  of  the  ANCOVA  and  summary  shows  that  there  were  no  significant  effects  or 
interactions  due  to  the  mixed  game  played  at  a  significance  level  of  a  <  0.05.  Thus,  the  mixed 
game  played  is  omitted  from  further  analysis.  However,  it  should  be  noted  that  the  mixed  game 
played  did  have  some  effects.  It  particularly  effected  the  interactions  between  the  mixed  game 
and  the  use  of  tools  and  between  the  mixed  game  and  those  who  were  defenders  in  both  rounds. 
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Thus,  this  data  suggests  that  the  mixed  game  type  did,  in  fact,  cause  some  differences  in 
equilibrium  scores.  This  observation  is  discussed  further  in  Chapter  5. 


4.4  Pure  Strategy  Score  and  Information  Warfare  Experience  Covariate  Analysis 

This  section  presents  an  analysis  of  the  effects  of  the  pure  strategy  score  and  IW 
experience  covariates.  Table  4-3  presents  the  complete  ANCOVA  Summary.  Although  the  full 
model  presented  in  Table  4-3  explains  only  about  22%  of  the  variation  in  the  mixed  game  scores, 
it  still  provides  enough  explanatory  power  to  assess  this  study’s  hypotheses. 


Table  4-3  ANCOVA  Summary 


Source 

Degrees 

Freedom 

F  Statistic 

Significance  (p) 

Eta  squared 

Pure  Score  Average 

1 

0.314 

0.577 

0.005 

IW  Experience 

1 

4.876 

0.031 

0.073 

Tools 

1 

0.186 

0.668 

0.003 

Defl 

1 

0.651 

0.423 

0.010 

Def2 

1 

0.146 

0.703 

0.002 

Tools  *  Defl 

1 

4.178 

0.045 

0.063 

Tools  *  Def2 

1 

5.795 

0.019 

Defl  *  Def2 

1 

0.113 

0.738 
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Overall  R"  =  0.215 

The  IW  Experience  F-statistic  4.876  at  a  significance  of  p  =  0.03 1  indicates  that  the  Null 
hypothesis  can  be  rejected  at  a  <  0.05.  The  regression  model  reported  that  the  IW  Experience 
coefficient  Pi  =  -5.536.  IW  Experience  caused  an  improvement  in  the  mixed  strategy  game 
score.  So,  Hypothesis  1  is  supported  by  the  data. 

The  pure  score  average  F-statistic  0.314  at  a  significance  of  p  =  0.577  indicates  that  the 
Null  hypothesis  (i.e.  that  the  pure  score  average  correlates  with  differences  in  the  mixed  strategy 
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score)  cannot  be  rejected  at  a  <  0.05.  The  evidence  does  not  show  that  the  pure  average  score 
effects  the  mixed  strategy  score.  So,  Hypothesis  2  is  not  supported  by  the  data. 

4.5  Manipulation  and  Interaction  Effects 


Defender  in  Pure  Game 


0  1 

Tools 


Figure  4-1  Defender  and  Tools  Interaction 

Attacker  in  Pure  Game 


0  1 

Tools 


Figure  4-1  Attacker  and  Tools  Interaction 
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The  primary  manipulation  in  this  experiment  was  the  application  of  learning  tools.  The 
interactions  between  tools  and  the  subject’s  role  (i.e.  defender  or  attacker)  must  also  be 
accounted  for.  Figures  4-1  and  4-2  show  the  interactions  between  Defender  in  the  pure  game 
and  tools  and  Defender  in  the  mixed  game  and  tools.  The  interaction  reveals  that  subjects  who 
were  Defenders  in  both  games  (i.e.  the  pure  strategy  and  mixed  strategy  games)  did  worse  with 
tools. 

The  summary  statistics  for  learning  tools  from  the  ANCOVA  are  shown  in  Table  4-3. 
Overall,  the  evidence  does  not  support  the  hypothesis  that  the  application  of  learning  tools  had 
any  effect  on  the  mixed  game  score.  However,  the  interactions  between  player  role  and  tools  are 
all  significant  at  a  <  0.05.  The  interaction  tables  suggest  that  subjects  who  were  attackers  in 
both  games  benefited  from  the  learning  tools  (Mean  without  tools  =  40,  Mean  with  tools  = 
31.33).  Conversely,  tools  hurt  equilibrium  performance  for  subjects  who  were  defenders  in  both 
games  (Mean  without  tools  =  31.5,  Mean  with  tools  =  39.33).  For  subjects  who  switched  from 
attacker  to  defender  or  vice-versa,  no  significant  effects  due  to  tools  appeared.  Overall,  there  is 
mixed  support  for  hypotheses  3.a  and  3.b. 

A  final  interaction  of  interest  is  that  of  subjects  who  were  defenders  in  both  games. 
Table  4-3  shows  the  summary  statistics  for  defenders  in  both  games  from  the  ANCOVA.  The  F- 
statistic  of  0.1 13  at  p  =  0.738  indicates  that  defenders  in  both  games  did  not  perform  significantly 
differently  than  other  subjects. 
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4. 6  Summary 


This  chapter  presented  and  analyzed  data  gathered  during  the  experiments.  It  also  related 
this  data  to  the  study’s  hypotheses.  Chapter  5  presents  an  assessment  of  the  data  analysis 
presented  here.  It  also  provides  further  explanations  of  the  observed  data.  Finally  it  provides  the 
limitations  of  this  study  and  recommendations  for  further  study. 
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5.  Conclusions  and  Recommendations 


5. 1  Introduction 

The  purpose  of  this  study  was  to  develop  and  evaluate  a  game  theory  model  of 
information  warfare,  based  upon  the  repeated  games  of  incomplete  information  model.  A  key 
component  of  a  game  theory  model  is  its  ability  to  predict  equilibrium.  Thus,  a  critical 
measurement  in  this  research  was  how  many  people  reached  equilibrium  play.  Another 
important  facet  of  a  game  theory  model  is  its  ability  to  analyze  behaviors  such  as  experience  and 
learning.  So  this  study  attempted  to  measure  the  effect  of  IW  experience.  Additionally,  learning 
during  an  IW  engagement  could  improve  performance.  Thus,  this  study  manipulated  the 
availability  of  learning  tools  and  measured  its  effects  on  equilibrium  performance. 

This  section  will  assess  the  measurements  presented  in  Chapter  4.  Likewise,  this  section 
will  assess  the  results  and  conclusions  for  each  hypothesis.  Next,  some  general  non-statistical 
observations  from  the  experiment  will  be  discussed.  The  final  sections  will  discuss  this  study’s 
limitations  and  recommendations  for  further  research. 

5.2  Equilibrium  Measures 

The  percentage  and  mean  scores  of  subjects  who  reached  equilibrium  (Table  4-1)  indicate  that  a 
slim  majority  of  subjects  reached  equilibrium.  Indeed,  the  key  limitation  of  this  study  was  the 
relatively  small  proportion  of  subjects  that  reached  equilibrium  play.  This  limitation  and  its 
implications  will  be  discussed  in  detail  later  in  this  Chapter.  However,  the  fact  the  many  subjects 
did  not  reach  equilibrium  in  this  experiment  does  not  suggest  that  they  were  playing  irrationally. 
Instead,  an  informal  analysis  of  general  game  play  suggests  that  players  were  playing  logically 
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and  reasonably,  on  average;  this  observation  will  be  discussed  in  detail  later  in  this  Chapter.  The 
remainder  of  this  section  will  discuss  equilibrium  play  in  the  pure  strategy  and  the  mixed 
strategy  games. 

5.2.1  Pure  Strategy  Equilibrium  Play 

Approximately  54%  of  subjects  reached  equilibrium  in  the  pure  strategy  game  with  an  average 
score  of  33.5.  As  discussed  in  Chapter  2,  equilibrium  play  in  the  pure  strategy  game  indicates  a 
general  understanding  of  the  IW  game  and  its  strategies.  The  fact  that  a  slim  majority  reached 
equilibrium  suggests  that  most  subjects  understood  the  basic  scenario  and  strategies  of  the  IW 
Model. 

5.2.2.  Mixed  Strategy  Equilibrium  Play 

Game  play  in  the  mixed  strategy  games  was  of  central  interest  in  this  study.  A  mixed 
strategy  is  much  more  representative  of  real-life,  where  one  must  both  respond  to  and  anticipate 
the  moves  of  the  opponent  -  which  cannot  be  done  by  playing  a  single  strategy.  However,  only 
50%  of  subjects  reached  equilibrium  in  game  Gss  and  35.7%  in  game  Gns-  Thus,  the  data 
suggests  that  the  majority  of  subjects  did  not  fully  understand  the  mixed  strategy  games. 

The  fact  that  the  averages  are  so  close  in  the  mixed  strategy  games  (36.3  and  36.4, 
respectively)  indicates  that  once  subjects  did  understand  the  mixed  game  Gns,  they  were  able  to 
reach  equilibrium  more  quickly  than  in  game  Gss •  This  may  result  from  the  fact  that  the 
equilibrium  in  game  GNs  was  subtler  than  that  in  GSs-  Specifically,  the  equilibrium  in  GSs  was 
driven  purely  by  playing  the  two  strategies  with  the  best  total  expected  value.  Gns,  on  the  other 
hand,  was  driven  more  by  the  success  probabilities  of  the  strategies,  which  was  unknown  to  the 
players.  In  other  words,  subjects  had  to  determine  which  strategies  were  the  most  likely  to 
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succeed  in  game  Gns  -  which  was  difficult  given  that  they  only  had  40  turns  to  play  the  game. 

5.3  Information  Warfare  Experience  and  Pure  Strategy  Score 

This  study  postulated  that  prior  experience  with  information  warfare  would  improve  equilibrium 
performance.  Similarly,  better  performance  in  the  pure  strategy  game  was  hypothesized  to 
correlate  with  improved  performance  in  the  mixed  strategy  games.  As  discussed  in  Chapter  2, 
the  pure  strategy  score  could  capture  a  multitude  of  factors  such  as  probabilistic  reasoning, 
concentration,  logic,  etc.  that  would  effect  the  mixed  strategy  score.  This  section  will  discuss  the 
effects  of  IW  experience  and  the  pure  strategy  score. 

5.3.1  Hypothesis  1 

Hypothesis  1  suggested  that  IW  experience  would  improve  performance  in  the  mixed 
strategy  games.  The  data  presented  in  Chapter  4  provides  support  for  this  hypothesis. 

Experience  with  information  warfare  could  influence  game  play  in  several  ways.  First, 
the  general  scenario  would  be  more  familiar  and  less  disconcerting  to  those  with  IW  experience. 
Second,  less  learning  would  be  required  to  become  familiar  with  the  basic  strategies  of  the  game 
so  more  effort  could  be  focused  on  determining  the  best  strategies.  Additionally,  those  with  IW 
experience  may  have  been  familiar  with  the  scenario  presented  in  the  experiment. 

5.3.2  Hypothesis  2 

Hypothesis  2  posited  that  better  equilibrium  play  in  the  pure  strategy  game  would 
correlate  with  better  equilibrium  performance  in  the  mixed  strategy  games.  The  data  presented 
in  Chapter  4  provides  no  support  for  this  hypothesis. 

The  primary  reason  for  the  lack  of  any  relationship  between  pure  strategy  play  and  mixed 
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strategy  play  is  the  fact  that  few  subjects  ever  reached  equilibrium  in  either  game.  Basically, 
there  was  not  a  sufficient  amount  of  data  on  which  to  base  any  conclusion.  Nonetheless,  it  is  not 
completely  surprising  that  pure  strategy  play  would  have  no  bearing  on  mixed  strategy  play.  The 
mindset  of  pure  strategy  play  is  different  than  that  of  mixed  play.  In  pure  strategy  play,  one  is 
concentrating  on  playing  a  single  strategy  -  no  matter  what  the  opponent  does.  In  mixed  strategy 
play,  on  the  other  hand,  the  player  must  continually  concentrate  on  the  opponent’s  actions  and 
adjust  his  or  her  own  strategy  accordingly. 

Additionally,  mixed  strategy  play  involves  randomizing  one’s  own  play  in  order  to  keep 
the  opponent  off  balance  (in  pure  strategy  games,  it  does  not  matter  what  the  opponent  does). 
Finally,  this  result  suggests  that  there  may  be  little  reason  to  maintain  support  for  a  pure  strategy 
style  of  play  in  the  IW  Model  since  it  has  no  impact  on  real  world  play. 

5.4  Hypothesis  3  -  Effect  of  Learning  Tools 

Hypotheses  3. a  and  3.b  posited  that  learning  tools  would  improve  equilibrium  play  in  the  mixed 
strategy  games.  The  learning  tools  would  allow  players  to  better  determine  what  strategy  mix 
yielded  the  best  payoff.  This  section  discusses  learning  tool  effects  and  the  interactions  with  the 
player’s  role  (i.e.  attacker  or  defender). 

5.4.1  Hypotheses  3. a  and  3.b 

The  data  presented  in  Chapter  4  provide  no  support  for  the  hypothesis  that  learning  tools 
improve  equilibrium  play,  in  general.  Again,  the  main  reason  for  this  finding  is  that  an 
insufficient  percentage  of  subjects  reached  equilibrium  to  support  any  conclusions.  An 
additional  reason  is  that  players  may  have  been  playing  in  a  different  style  than  that  supported  by 
the  learning  tools. 
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The  learning  tools  used  in  the  experiment  were  based  on  a  learning  process.  As  discussed 
in  Chapter  2,  this  learning  process  requires  that  players  be  given  more  information  about  the 
history  of  the  game.  This  information  then  supports  the  fictitious  play  model.  Recall  that 
fictitious  play  involves  players  studying  the  game’s  history,  determining  what  moves  would  have 
been  better,  and  applying  the  refined  strategy  to  future  turns.  However,  if  players  are  reacting 
purely  to  the  moves  of  their  opponent  or  to  the  payoffs  that  they  have  received,  they  may  not  be 
actively  trying  to  learn  more  about  the  game.  Indeed,  game  play  in  this  experiment  distinctly 
showed  a  best  response  as  opposed  to  an  adaptive  learning  style  of  play  (this  statement  will  be 
discussed  shortly).  Thus,  more  information  such  as  that  provided  by  the  learning  tools  could 
have  little  impact  on  game  play. 

The  research  discussed  in  Chapter  2  suggested  that  people  generally  employ  learning 
when  playing  more  complex  games,  such  as  the  IW  Model,  thus  learning  tools  were  used. 
However,  the  particular  structure  of  the  payoffs  in  the  mixed  strategy  games  may  have  prevented 
players  from  employing  a  learning  strategy;  this  statement  will  be  discussed  in  more  detail 
shortly. 

5.4.2  Interactions  between  Tools  and  Player  Role 

Although  tools  failed  to  show  any  effect  on  equilibrium  play  in  general,  the  ANCOVA 
interactions  revealed  that  tools  impacted  defenders  and  attackers  differently.  Since,  tools 
impacted  attackers  and  defenders  in  opposite  ways,  the  overall  effect  due  to  tools  could  have 
been  cancelled  out.  In  any  case,  the  interactions  provide  the  basis  for  the  following  observations. 

As  noted  in  Chapter  2,  defenders  had  access  to  more  information  than  attackers. 
Specifically,  defenders  could  determine  the  attackers’  moves  by  observing  their  own  payoffs. 


This  additional  information  was  based  upon  information  warfare  technologies  such  as  network 
monitoring  devices.  However,  this  additional  information  directly  contributes  to  a  best  response 
as  opposed  to  a  learning  style  of  play.  So,  the  information  provided  by  the  learning  tools  could 
be  extraneous  or  even  distracting.  This  conclusion  is  supported  by  the  interaction  data  provided 
in  Chapter  4.  Specifically  that  the  mean  score  for  defenders  without  tools  (31.5)  was  less  (better) 
than  with  tools  (39.3).  Obviously  such  a  post  hoc  conclusion  requires  validation.  The 
implications  of  this  finding  on  information  warfare  are  discussed  later  in  this  report. 

Proceeding  from  the  above  discussion  would  suggest  that  attackers  should  benefit  from 
learning  tools.  Since  they  are  at  an  initial  informational  deficit,  they  cannot  directly  employ  a 
best  response  strategy.  Instead,  they  must  analyze  the  relative  successes  of  their  own  strategies 
and  determine  the  best  mix.  A  learning  process  would  support  the  attacker’s  strategy  analysis. 
The  interaction  data  presented  in  Chapter  4  supports  this  conclusion.  Specifically,  the  mean 
score  for  attackers  with  tools  (31.33)  is  less  than  without  tools  (40.00).  Indeed,  the  attackers  in 
this  study  could  not  reach  equilibrium  without  the  learning  tools.  Again,  this  post  hoc 
conclusion  requires  further  validation.  The  implications  of  this  finding  on  information  warfare 
will  be  discussed  later  in  this  report. 

5.5  General  Observations  Regarding  Game  Play 

When  calculating  the  number  of  turns  to  reach  equilibrium,  several  general  “themes” 
emerged.  As  mentioned  previously,  a  general  best  response  strategy  was  played  even  when 
equilibrium  was  not  reached.  A  best  response  strategy  is  one  in  which  the  player  alters  their 
strategy  to  counter  their  opponent’s  moves,  even  if  the  response  is  less  optimal  than  the 
equilibrium  strategy.  Additionally,  players  seemed  to  recognize  which  strategy  had  the  highest 
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probability  of  success  and  would  favor  that  strategy,  even  if  its  expected  value  was  lower  than 
other  strategies.  For  example,  the  social  attack  strategy  may  have  had  a  payoff  of  70,  but  would 
only  succeed  15%  of  the  time  whereas  the  client  attack  may  have  only  had  a  payoff  of  40  but 
succeeded  40%  of  the  time.  In  this  case,  many  subjects  favored  the  more  successful  client 
attack,  although  they  would  have  realized  a  greater  long-run  payoff  with  the  social  attack.  Most 
likely,  the  short  time  span  of  the  game  (40  turns)  prevented  players  from  determining  the 
expected  value  for  each  strategy.  These  observations  suggest  that  subjects  were  playing 
rationally,  even  when  not  reaching  equilibrium.  This  is  a  significant  observation  since  most 
formal  models  of  social  behavior,  particularly  game  theory,  rest  on  the  assumption  of  rationality. 

The  player  type  as  a  component  of  the  repeated  games  of  incomplete  information  model 
was  discussed  in  Chapter  2.  In  the  IW  Model,  the  player’s  type  determined  what  type  of 
information  (social,  network,  or  client)  they  preferred.  In  this  discussion,  it  was  suggested  that 
the  player  type  might  not  influence  the  IW  Model  equilibrium  because  players  would  be  unaware 
of  their  type.  Additionally,  the  payoffs  and  success  probabilities  were  configured 
(unintentionally)  so  that  the  equilibrium  strategy  did  not  necessarily  match  up  with  the  player’s 
type.  During  equilibrium  analysis,  it  was  found  that  many  players  did  in  fact  play  according  to 
their  type.  Specifically,  they  would  play  the  strategy  that  best  protected  their  preferred 
information,  even  if  it  was  not  the  best  equilibrium  strategy.  The  fact  that  player  types  were  not 
accounted  for  in  the  equilibrium  calculations  is  a  significant  limitation  of  this  study,  and  is 
discussed  shortly.  However,  the  fact  that  some  players  discerned  their  type  suggests  that  they 
understood  the  underlying  IW  Model. 
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5. 6  Study  Limitations 


This  study’s  limitations  will  be  presented  in  two  parts.  First,  limitations  of  the  IW  Model  and 
equilibrium  calculation  will  be  presented.  Then,  limitations  of  the  study’s  methodology  will  be 
discussed.  In  each  subsection,  possible  extensions  to  the  IW  Model  will  be  introduced,  where 
appropriate. 

5.6.1  IW  Model  and  Equilibrium  Limitations 

As  noted  previously,  the  primary  limitation  of  this  study  was  the  inability  of  subjects  to 
reach  equilibrium.  As  discussed  in  previous  sections,  problems  with  equilibrium  calculation 
seem  to  be  the  main  problem.  Little  evidence  emerged  that  raised  questions  about  the  IW  Model 
itself. 

The  40-tum  horizon  of  actual  game  play  contributed  to  subjects’  inability  to  calculate 
expected  values,  determine  probabilities,  and  generally  calculate  the  best  equilibrium  strategy. 
Forty  turns  may  simply  have  not  been  long  enough  for  players  to  determine  the  equilibrium 
strategy.  A  more  serious  problem  is  that  equilibrium  for  finite  horizon  and  infinite  horizon 
games  can  be  different.  Chapter  2  suggested  that  since  players  would  not  know  how  many  turns 
they  were  playing,  they  would  be  playing  as  if  there  were  an  infinite  horizon.  Consequently, 
equilibrium  was  calculated  based  upon  an  infinite  horizon.  The  assumption  of  an  infinite 
horizon  may  have  been  incorrect.  Since  players  knew  that  they  would  only  be  participating  in 
the  experiment  for  a  finite  period,  they  knew  the  game  could  not  last  forever.  Thus,  they  could 
have  played  in  accordance  with  finite-horizon  equilibrium.  Future  research  could  compare 
equilibrium  results  between  finite-horizon  equilibrium  and  infinite-horizon  equilibrium. 

The  strategy  success  probability  could  also  have  affected  equilibrium  play.  Since 
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equilibrium  was  calculated  based  upon  the  expected  values  (i.e.  the  pure  payoff  multiplied  by  the 
success  probability)  players  would  have  to  determine  the  probabilities  to  determine  equilibrium. 
Additionally,  success  probabilities  obscured  a  player’s  type,  sometimes  yielding  an  equilibrium 
strategy  that  did  not  coincide  with  the  player  type.  Overall,  success  probabilities  must  be  more 
rigorously  incorporated  into  the  general  IW  Model  and  players  must  be  given  more  information 
about  their  success  probabilities. 

Finally,  the  fact  that  player  types  were  not  incorporated  into  equilibrium  calculation  may 
have  prevented  some  subjects  from  reaching  equilibrium.  The  assumption  that  player  types 
would  not  have  an  impact  on  actual  game  play  was  apparently  incorrect.  Thus,  equilibrium 
calculations  should  account  for  player  type  (as  demonstrated  in  Chapter  2).  Accounting  for 
player  type  could  produce  a  more  robust  and  accurate  model  of  information  warfare. 

5. 6.2  Experimental  Methodology  Limitations 

One  key  limitation  was  that  the  roles,  defenders  and  attackers,  were  randomly  assigned. 
As  shown  in  Chapter  4,  the  role  had  a  significant  interaction  with  tools.  So,  better  control  over 
role  assignment  may  have  increased  statistical  reliability.  Specifically,  the  numbers  of  subjects 
in  the  various  interaction  groups  (such  as  defender  in  the  pure  strategy  game,  attacker  in  the 
mixed  game  with  tools)  were  not  equal.  This  results  in  unequal  variances  between  groups. 

The  small  number  of  subjects  presented  another  limitation.  Although  the  multiple  turns 
allowed  more  data  points  to  be  collected,  the  small  number  of  subjects  reduced  overall  variation. 
Additionally,  the  multiple  turn  configuration  causes  an  large  increase  in  data  points  for  even  a 
small  increase  in  subjects.  For  instance,  8  more  subjects,  evenly  distributed  across  treatments 
would  have  resulted  in  128  data  points  rather  than  72.  The  multiple  turn  configuration  is  a 
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strength  of  the  study,  however,  the  limited  subject  pool  was  a  limitation. 

Another  limitation  of  the  study  was  the  calculation  of  the  number  of  rounds  to  reach 
equilibrium.  A  more  rigorous  method  for  calculating  equilibrium  could  improve  the  variation  in 
equilibrium  scores  in  this  study.  First,  it  could  allow  equilibrium  to  be  reached  in  fewer  turns. 
Second,  it  would  increase  consistency  across  subjects.  Surface  response  analysis  and  other 
optimization  methods  are  possible  routes  to  improve  equilibrium  score  calculation. 

5. 7  Recommendations  for  Future  Research 

The  first  recommendation  for  future  research  would  be  to  include  some  of  the 
equilibrium  calculation  enhancements  discussed  in  previous  sections.  These  enhancements 
could  improve  the  rate  of  equilibrium  attainment  and  improve  all  findings.  Additionally,  the 
enhancements  would  improve  the  utility  of  the  IW  Model.  Indeed,  a  future  study  based  on  these 
enhancements  could  be  performed  with  the  same  methodology  and  software  in  which  this  study 
was  performed. 

Incorporating  more  aspects  of  information  warfare  into  the  IW  Model  presents  another 
avenue  for  future  research.  More  detailed  strategies  and  scenarios  are  fairly  simple  extensions. 
Deeper  extensions  include  the  addition  of  more  strategies  and  the  ability  to  employ  multiple 
strategies  in  the  same  turn.  Budgetary  considerations,  such  as  rationing  a  limited  budget  over  all 
turns  would  also  be  an  interesting  extension.  Finally,  incorporating  learning  directly  into  the 
model  could  shed  light  on  equilibrium  behavior.  Specifically,  during  each  turn  the  success 
probabilities  of  the  strategies  could  be  adjusted  to  reflect  the  experience  gained  while  conducting 
the  information  warfare  operation. 

Case  study  research  could  also  help  develop  the  IW  Model.  A  specific  information 
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warfare  operation  could  be  studied  and  it’s  various  elements,  such  as  the  strategies  used  and  the 
relative  payoffs  could  be  incorporated  into  the  IW  Model’s  payoff  matrix.  Then,  theoretical 
equilibrium  could  be  calculated  from  the  model.  Next,  the  actual  operation  could  be  studied  to 
see  if  the  participants  played  at  equilibrium.  Even  if  they  did  not  play  at  equilibrium,  the 
exercise  could  possibly  show  better  strategies,  weaknesses  in  the  information  defense  policies,  or 
opportunities  for  technology  improvements. 

As  a  final  note,  the  key  component  of  this  line  of  research  is  to  develop  a  model  that 
allows  information  warfare  simulations,  analysis  of  information  warfare  behavior,  and  suggests 
methods  for  improvement  in  information  warfare  operations.  Further  refinement  of  the  game 
theory  IW  Model  itself  and  the  incorporation  of  more  information  warfare  components  into  the 
model  are  two  major  avenues  of  research  towards  these  goals. 

5.8  Final  Conclusions 

Overall,  the  results  of  this  study  show  that  developing  a  game  theory  model  of 
information  warfare  holds  promise  for  better  understanding  and  analyzing  the  behavior  of  IW 
participants.  Additionally,  the  IW  Model  could  shed  light  on  how  to  conduct  IW  operations, 
such  as  this  study’s  brief  analysis  of  learning  tools  and  their  application  to  IW  technologies. 
Despite  the  fact  that  many  subjects  did  not  reach  equilibrium  when  playing  the  game,  their 
rational  style  of  play  suggests  that  a  formal  method  for  analyzing  information  warfare,  such  as 
game  theory,  is  not  fruitless.  This  study’s  experimental  methodology  and,  in  particular,  the 
experiment’s  software  provide  some  of  the  tools  necessary  to  develop  and  test  game  theory 
models  of  information  warfare. 

Even  from  this  limited  study,  several  conclusions  about  information  warfare  and  how  to 
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model  it  emerged.  Although  much  work  remains  before  a  more  robust  game  theory  IW  model  is 
realized,  this  study  shows  that  the  realistic  possibility  of  completely  developing  such  a  model 
exists. 
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Defender  Scenario 


You  are  the  Chief  Information  Officer  (CIO)  for  Megalith,  Inc.,  a  United  States  conglomerate  of 
financial  and  manufacturing  firms.  At  the  latest  meeting  of  senior  executives,  you  learned  that 
one  of  Megalith’s  European  competitors,  Orwell  Inc.,  has  decided  to  engage  in  offensive 
information  warfare  against  your  company.  Orwell  hopes  to  gain  sensitive  information  and  to 
disable  Megalith’s  information  systems.  The  US  State  Department  has  stated  that  they  cannot 
intervene  on  your  behalf  because  of  sensitive  diplomatic  negotiations  with  Orwell’s  home  nation. 
Thus,  it’s  up  to  you  to  defend  Megalith’s  information  systems. 

You  have  since  learned  that  Orwell  has  developed  three  general  attack  strategies,  which  are  briefly  described  below. 
Each  month.  Orwell  will  devote  all  of  its  resources  to  one  of  these  strategies. 

1.  Social  Engineering:  This  strategy  involves  the  use  of  non-technical  methods  to  obtain  sensitive 
information,  penetrate  corporate  networks,  or  disrupt  information  system  operation.  Social 
Engineering  involves  methods  such  as:  password  guessing,  posing  as  network  administrators  to  obtain 
passwords,  using  false  identities  over  the  phone  or  in  person,  physical  penetration  of  computer  or 
corporate  facilities,  monitoring  telephones,  and  accessing  employee  computers  while  they  are  away 
from  their  desks. 

2.  Client  Attack:  This  strategy  involves  disrupting  or  compromising  desktop  computers  that  all 
employees  use  at  Megalith.  Client  Attacks  involve  methods  such  as:  computer  viruses  (particularly 
email  attachment  viruses),  log-in  spoofing  (i.e.  a  false  log-in  screen  is  displayed  to  obtain  the  user  s 
password),  and  changing  computers’  startup  and  configuration  files  (which  can  be  done  remotely  in 
Windows95/98). 

3.  Network  Attack:  This  strategy  involves  disrupting  or  compromising  Megalith’s  computer  network; 
this  can  impede  email,  file  sharing,  printer  use,  and  the  use  of  shared  applications  (among  other 
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things).  Network  attacks  are  directed  at  file  servers,  routers  (devices  that  connect  and  control  the 
network’s  cabling),  domain  name  servers  (computers  that  allow  the  use  of  human  friendly  names  such 
as  www.megalith.com),  and  any  other  component  on  the  network. 

Your  Information  Security  department  has  developed  three  defense  strategies  to  counter  each  of  the  above  attacks. 
Each  month,  you  will  select  one  of  these  strategies  to  employ.  Although  each  defense  strategy  counters  a  specific 
attack,  they  also  have  limited  effectiveness  against  the  other  attack  strategies.  Your  defense  strategies  are  not 
cumulative.  Thus,  you  will  begin  anew  each  month.  At  the  end  of  each  month,  you  will  receive  a  report  indicating 
the  costs  of  any  information  resources  that  were  compromised.  Your  defense  strategies  are  described  below: 

1 .  Social  Engineering  Defense:  This  strategy  primarily  involves  training  programs.  Users  are  trained  on 
proper  password  selection,  when  and  how  to  change  passwords,  recognizing  network  administrators, 
proper  information  to  discuss  over  networks  of  phones,  and  other  computer  security  precautions. 
Additionally,  corporate  facilities  are  secured  against  intrusion  (i.e.  guards,  security  alarms,  etc.) 
Finally,  security  background  checks  can  be  used  for  computer  users  and  especially  system 
administrators. 

2.  Client  Defense:  The  main  defense  here  is  virus  protection.  All  desktop  computers  are  installed  with 
virus  protection  programs  that  monitor  all  files  and  email  attachments.  Additionally,  desktops  are 
protected  against  remote  access  and  administration  (most  of  this  is  done  through  Windows).  Finally, 
file  encryption  can  be  used  to  protect  sensitive  files  and  email. 

3.  Network  Defense:  Network  firewalls  are  the  primary  network  defense.  Network  firewalls  are  devices 
that  prevent  network  access  from  unauthorized  locations.  Secure  routers  supplement  network  firewall 
protection.  Additionally,  network  communications  can  be  encrypted  to  prevent  unauthorized 
interception. 
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Attacker  Scenario 


You  are  the  Chief  Information  Officer  for  Orwell  Inc.,  a  European  conglomerate  of 
manufacturing  and  financial  firms.  Your  biggest  competitor,  the  US-based  Megalith  Inc.,  has 
steadily  eroded  Orwell’s  market  share  and  profitability  in  the  last  few  months.  At  the  last 
meeting  of  senior  executives,  it  was  decided  that  Orwell  Inc  (i.e.  you)  would  employ  offensive 
information  warfare  to  gain  Megalith’s  secrets  and  to  disrupt  its  information  systems.  Hopefully, 
this  will  improve  Orwell’s  ability  to  compete  with  Megalith.  Representatives  from  Orwell  have 
already  persuaded  your  national  government  to  “look  the  other  way”  while  you  conduct  your 
information  warfare  operations.  Thus,  you  may  employ  whatever  strategies  you  desire. 

You  have  since  assembled  a  team  of  professional  computer  crackers  (hackers  only  penetrate  systems,  crackers 
penetrate  and  disrupt)  and  they  have  developed  three  general  attack  strategies.  Each  month,  you  will  devote  all  of 
your  resources  towards  one  of  these  strategies.  At  the  end  of  each  month,  you  will  receive  a  report  indicating  the 
value  resulting  from  your  information  warfare  operations.  Your  attack  strategies  are  described  below: 

4.  Social  Engineering:  This  strategy  involves  the  use  of  non-technical  methods  to  obtain  sensitive 
information,  penetrate  corporate  networks,  or  disrupt  information  system  operation.  Social 
Engineering  involves  methods  such  as:  password  guessing,  posing  as  network  administrators  to  obtain 
passwords,  using  false  identities  over  the  phone  or  in  person,  physical  penetration  of  computer  or 
corporate  facilities,  monitoring  telephones,  and  accessing  employee  computers  while  they  are  away 
from  their  desks. 

5.  Client  Attack:  This  strategy  involves  disrupting  or  compromising  desktop  computers  that  all 
employees  use  at  Megalith.  Client  Attacks  involve  methods  such  as:  computer  viruses  (particularly 
email  attachment  viruses),  log-in  spoofing  (i.e.  a  false  log-in  screen  is  displayed  to  obtain  the  user’s 
password),  and  changing  computers’  startup  and  configuration  files  (which  can  be  done  remotely  in 
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Windows95/98). 

6.  Network  Attack:  This  strategy  involves  disrupting  or  compromising  Megalith’s  computer  network; 
this  can  impede  email,  file  sharing,  printer  use,  and  the  use  of  shared  applications  (among  other 
things).  Network  attacks  are  directed  at  file  servers,  routers  (devices  that  connect  and  control  the 
network’s  cabling),  domain  name  servers  (computers  that  allow  the  use  of  human  friendly  names  such 
as  www.megalith.com),  and  any  other  component  on  the  network. 

You  have  also  discovered  that  Megalith  Inc.  has  learned  of  your  intentions.  They  have  developed  three  counter 
strategies  to  defend  against  your  attacks.  Likewise,  they  will  employ  one  of  these  strategies  each  month.  Their 
defenses  are  not  cumulative;  they  must  start  a  new  defense  each  month.  Here  is  what  you  have  learned  about  their 
defenses: 

4.  Social  Engineering  Defense:  This  strategy  primarily  involves  training  programs.  Users  are  trained  on  proper 
password  selection,  when  and  how  to  change  passwords,  recognizing  network  administrators,  proper 
information  to  discuss  over  networks  of  phones,  and  other  computer  security  precautions.  Additionally, 
corporate  facilities  are  secured  against  intrusion  (i.e.  guards,  security  alarms,  etc.)  Finally,  security  background 
checks  can  be  used  for  computer  users  and  especially  system  administrators. 

5.  Client  Defense:  The  main  defense  here  is  virus  protection.  All  desktop  computers  are  installed  with  virus 
protection  programs  that  monitor  all  files  and  email  attachments.  Additionally,  desktops  are  protected  against 
remote  access  and  administration  (most  of  this  is  done  through  Windows).  Finally,  file  encryption  can  be  used 
to  protect  sensitive  files  and  email. 

6.  Network  Defense:  Network  firewalls  are  the  primary  network  defense.  Network  firewalls  are  devices  that 
prevent  network  access  from  unauthorized  locations.  Secure  routers  supplement  network  firewall  protection. 
Additionally,  network  communications  can  be  encrypted  to  prevent  unauthorized  interception. 
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ATTACKER  GAME  HELP 


PAYOFF  MATRIX 

The  Payoff  Matrix  indicates  the  value  of  information  resources  you  gain  when  your  Attack  Strategy  succeeds.  If 
your  Attack  Strategy  fails,  you  gain  nothing.  The  actual  value  that  you  obtain  depends  upon  both  the  Attack 
Strategy  that  you  chose  and  the  Defense  Strategy  chosen  by  your  opponent.  In  the  highlighted  example  below,  you 
receive  $70Million  if  and  only  if  the  Social  Attack  strategy  succeeds  and  the  Social  Defense  was  used.  Its  important 
to  note  that  the  Defender  may  or  may  not  lose  the  same  amount  that  you  receive  (this  is  not  a  zero  sum  game).  In 
the  below  example,  the  Defender  may  only  lose  $50Million  although  you  gained  $70Million.  Indeed,  the 
Defender’s  payoff  matrix  may  look  much  different  than  yours.  Thus  you  should  not  immediately  assume  that  the 
Defender  values  their  strategies  in  the  same  way  that  you  do. 


Social 

Defense 

Client 

Defense 

Network 

Defense 

Social  Attack 

70 

70 

70 

C  lient  Attack 

50 

50 

50 

Network 

Attack 

25 

25 

25 

Notice  that  you  will  not  be  able  to  determine  the  actual  Defense  Strategies  employed  by  the  Defender.  Thus,  you 
should  concentrate  on  determining  which  Attack  Strategies  succeed  most  often  (see  below  for  more  information). 


STRATEGY  SUCCESS 

Although  it  appears  that  your  Attack  Strategies  yield  the  same  payoffs  regardless  of  the  Defense  strategy,  this  is  not 
the  case.  The  Defense  Strategies  will  be  more  effective  against  some  of  your  attacks  than  against  others.  For 
example,  if  you  use  a  Social  Attack  while  the  Defender  uses  a  Network  Defense,  you  may  have  a  higher  chance  of 
success  than  if  your  opponent  used  a  Social  Defense.  So,  if  you  have  achieved  a  high-level  of  success  for  a  few 
turns  and  then  suddenly  realize  less  success,  its  quite  likely  that  the  Defender  has  employed  a  different  Defense 
Strategy  that  is  more  effective  against  your  current  Attack  Strategy.  For  instance,  if  you  have  played  the  Social 
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Attack/Network  Defense  scenario  above  and  suddenly  experience  several  losing  turns,  the  Defender  may  have 
switched  to  a  Social  Defense  to  counter  your  Social  Attack. 

The  “Approximate  Chance  of  Success”  area  of  your  Game  screen  shows  the  averaged ,  approximate  chance  of 
success  for  each  of  your  strategies.  THESE  VALUES  ARE  OiSLY  A  GUIDE  TO  HELP  GET  YOU  STARTED, 
You  will  notice  that  Attack  Strategies  are  more  effective  against  particular  types  of  Defenses.  Additionally,  you 
may  notice  that  an  Attack  Strategy  with  a  low  overall  chance  of  success  may  be  very  effective  against  one  type  of 
Defense.  For  instance,  the  Network  Attack  may  be  very  effective  against  the  Client  Defense  (60%  or  better)  but 
ineffective  against  other  defenses  (25%  or  worse). 

A  KEY  EACTOR  IS  SELECTING  THE  BEST  STRATEGY  OR  COUBISA  TIPS  OE  STRATEGIES  IS 
DETERM  IS  I XG  M  HEX  YOUR  A  TTACK  STRA  TEGIES  ARE  MOST  EFFECTIVE. 


79 


DEFENDER  GAME  HELP 


PAYOFF  MATRIX 

The  Payoff  Matrix  indicates  the  costs  of  compromised  information  resources  when  a  particular  Defense  Strategy 
fails.  The  actual  cost  depends  upon  the  Defense  Strategy  chosen  and  the  Attacker’s  Strategy.  The  sample  payoff 
matrix  below  shows  that  you  will  lose  $70Million  if  your  Social  Defense  Strategy  fails  against  a  Social  Attack. 
However,  if  your  Social  Defense  succeeds,  you  lose  nothing.  Two  important  items  should  be  noted  here.  First, 
when  your  Defense  strategy  succeeds,  the  Attacker  gains  nothing.  However,  when  your  Defense  Strategy  fails,  the 
Attacker  may  or  may  not  gain  the  same  amount  that  you  have  lost  (i.e.  this  is  not  a  zero-sum  game).  In  the  below 
example,  if  your  Social  Defense  strategy  fails  and  you  lose  $70Million,  the  Attacker  may  only  realize  a  gain  of 
$50Million.  Indeed,  the  Attacker’s  payoff  matrix  may  look  much  different  that  yours.  Thus,  you  should  not 
immediately  assume  that  the  Attacker  values  their  strategies  in  the  same  way  that  you  do. 


Social 

Defense 

Client 

Defense 

Network 

Defense 

Social  Attack 

-70 

-70 

-70 

Client  Attack 

-50 

-50 

-50 

Network 

Attack 

-25 

-25 

-25 

Notice  that  if  your  Defense  strategy  does  fail,  you  will  be  able  to  determine  the  strategy  that  the  Attacker  used  by 
noticing  how  much  money  you  lost.  In  the  above  example,  you  would  be  able  to  determine  that  your  opponent  used 
a  Social  Attack. 


STRATEGY  SUCCESS 


Although  you  cannot  directly  select  your  own  payoff,  you  will  quickly  notice  which  of  your  strategies  are  more 
effective  (Le.  those  that  succeed  more  often).  Additionally,  your  Defense  Strategies  are  more  effective  against 
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some  attacks  than  they  are  against  others.  Thus,  your  Social  Defense  may  be  very  effective  against  a  Social  Attack, 
but  only  moderately  effective  against  a  Client  Attack. 

The  “Approximate  Chance  of  Success”  area  of  your  Game  screen  shows  the  averaged \  approximate  chance  of 
success  for  each  of  your  strategies.  THESE  VALVES  ARE  ONL  V  A  GUIDE  TO  HELP  GET  YOU  STARTED . 
You  will  notice  that  Defense  Strategies  are  more  effective  against  particular  types  of  Attacks.  Additionally,  you 
should  notice  that  a  Defense  Strategy  with  a  low  overall  chance  of  success  may  be  very  effective  against  one  type  of 
attack.  For  instance,  the  Network  Defense  may  be  very  effective  against  the  Network  Attack  (60%  or  better)  but 
ineffective  against  other  attacks  (25%  or  worse). 

A  KEY  FACTOR  IS  SELECT!  XG  THE  BEST  STRATEGY  OR  COM  BIS  A  TIPS  OF  STRATEGIES  IS 
DETERM f  \I.\G  H  HEX  YOi  R  DEEESSE  STRA  TEGIES  ARE  MOST  EFFECTIVE. 
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GAME  ENHANCEMENTS 


Three  Average  Payoff  boxes,  one  for  each  move,  have  been  added  to  the  upper,  left-hand  side  of 
the  Game  Form.  These  boxes  show  the  average  payoff  for  each  move,  averaged  over  the  number 
of  turns  that  you  have  played  the  move.  Each  box’s  average  is  updated  after  you  use  that  move. 
The  example  below  shows  how  this  works: 

Suppose  that  you  have  played  5  turns  so  far,  as  shown  in  the  table  below:  (NOTE:  All 
three  strategies  will  be  shown  on  the  game  form. 


TURN 

MOVE 

PAYOFF 

RECEIVED 

AVERAGE  PAYOFFS 

1 

Client  Attack 

0 

Client  Attack  :v:  0 

Social  Attack  =  0 

2 

Social  Attack 

75 

Client  Attack  =  0 

Social  Attack  =  75 

3 

Client  Attack 

25 

Client  Attack  --  12.5 

Social  Attack  =  75 

4 

Social  Attack 

0 

Client  Attack  =  1 2.5 

Social  Attack  =  37.5 

5 

Social  Attack 

50 

Client  Attack  -  1 2.5 

Social  Attack  =  41 .67 

Since  your  goal  is  to  make  as  much  possible,  you  should  favor  strategies  that  have  the  highest 
Average  Payoffs.  Keep  in  mind  that  the  Average  Payoff  will  become  more  accurate  as  more 
turns  are  played. 

Below  the  Average  Payoff  boxes  is  a  scroll-box  that  shows  the  moves  and  payoffs  for  each  turn 
of  the  game.  This  box  allows  you  to  see  what  moves  you  have  made  previously  and  what  payoff 
you  received  for  those  moves. 
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Appendix  B:  Experiment  Instructions  and  Checklist 
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Instructions 


Thank  you  for  participating  in  this  experiment.  This  experiment  involves  playing  a  simple  Information 
Warfare  based  game.  You  may  terminate  your  participation  in  this  experiment  at  any  time.  The 
experiment  is  designed  to  proceed  uninterrupted,  however,  if  you  need  to  pause  for  any  reasons  please 
notify  the  experimenter  immediately.  Please  do  not  use  writing  materials,  calculators,  or  other  external 
devices  during  the  experiment.  Also,  please  do  not  have  any  other  software  applications  open  on  your 
computer  during  the  experiment.  Finally,  please  do  not  speak  to  other  subjects  during  the  experiment  (in 
particular,  do  not  reveal  your  strategies  or  winnings/losses).  Thank  you  for  your  cooperation. 

If  you  encounter  a  software  error  during  the  experiment,  please  cease  all  activity  and  notify  the 
experimenter  immediately.  Likewise,  if  you  have  a  question  during  the  experiment,  please  notify 
the  experimenter  immediately. 

The  purpose  of  this  experiment  is  to  test  and  validate  a  game  theory  model  that  encompasses  some  basic 
aspects  of  information  warfare.  Game  theory  is  a  technique  frequently  used  in  economics  and  other  social 
sciences  to  model  social  behavior.  The  primary  motivation  for  developing  a  game  theory  model  is  to 
simplify  complex  social  situations.  The  simplified  model  can  then  allow  better  understanding  of  people  s 
actions  and  the  reasons  for  their  actions.  Additionally,  game  theory  models  can  provide  limited  predictive 
power  in  some  social  situations. 

The  inclusion  of  information  warfare  attributes  is  a  significant  extension  of  current  game  theory  models. 
Thus,  only  basic,  high-level  aspects  of  information  warfare  are  included  in  this  study’s  model.  Please 
keep  in  mind  that  this  is  essentially  a  game  theory  study  -  not  an  Information  Warfare  study. 
During  the  course  of  the  experiment,  please  do  not  become  concerned  with  the  technical 
implications  of  the  Information  Warfare  scenario  presented.  Your  goal  is  to  maximize  your  payoffs 


while  minimizing  your  losses  -  REGARDLESS  OF  WHAT  PREVIOUS  IW  EXPERIENCE  MAY 


INDICATE. 


Each  of  you  will  have  three  strategies  available.  These  strategies  and  the  overall  scenario  will  be 
explained  in  detail  when  you  begin  the  experiment.  Your  overall  goal  is  to  determine  and  employ  the 
combination  of  strategies  that  yields  you  the  best  long-term  payoff.  Under  some  conditions,  it  may  be 
advantageous  to  use  a  combination  of  two  or  all  three  strategies  to  keep  your  opponent  unaware  of  your 
actions.  At  other  times,  it  may  be  better  to  use  only  one  strategy.  During  the  first  few  turns,  you  should 
complete  the  following  actions: 

1)  Determine  your  best  strategy(s),  i.e.  those  that  seem  to  succeed  most  often  and  that  yield  the  best, 
long-term  payoff. 

2)  If  no  single  strategy  seems  best,  determine  the  combination  of  strategies  that  yields 
higher  long-term  payoffs. 

3)  Attempt  to  determine  the  preferred  strategy(s)  of  your  opponent  and  alter  your  strategy  accordingly. 

4)  When  you  believe  you  have  found  the  best  strategy  or  combination  of  strategies,  continue  using  it 
unless  your  overall  payoffs  seriously  decline. 
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EXPERIMENT  PROTOCOL 


1)  Place  subject  number  cards  at  workstations  as  follows:  Odd  numbers  on  far- wall,  starting  from 
left  to  right,  Even  Numbers  on  near-wall,  starting  right  to  left. 

2)  Seat  subjects  at  numbered  workstations,  ensuring  that  all  number  pairs  (i.e.  1  &  2,  5&6,  etc.) 
are  matched. 

3)  Have  subjects  log  into  their  AFIT  computer  accounts.  Verify  that  all  subjects  are  logged  in. 

4)  Have  subjects  open  experiment  database  and  STOP. 

FILE  LOCATION: _ _ _ 

5)  Verify  that  all  subjects  have  gained  access  to  experiment  database. 

6)  Distribute  All-Subject,  Session  1  Instructions.  Experimenter  then  reads  instructions  aloud. 

7)  Ask  subjects  to  enter  their  Subject  Number  (from  card)  and  to  answer  the  questions  on  the 
Subject  Identification  form. 

8)  Ask  subjects  to  read  “The  Scenario”  form  to  themselves  and  hit  Continue  button  when 
complete. 

9)  Ask  subjects  to  hit  the  “Move  Help”  button  on  the  Game  Form,  read  the  instructions,  hit  the 
“Done”  button,  and  then  STOP.  Notify  subjects  that  the  Move  Help  button  is  accessible 
throughout  the  experiment. 

10)  When  all  Subjects  have  read  the  Move  Help  screen,  they  may  begin  making  moves. 

1 1)  Ask  subjects  not  to  leave  until  dismissed  by  the  experimenter. 

12)  If  questions  or  software  errors  arise,  have  all  subjects  stop. 
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Appendix  C:  Experiment  Database  Tables  and  Relationships 
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RecordID 

Turn 

MatchID 

AttackPayoff 

DefendPayoff 


SubjectID  — 
Defender 


' — MatchID 
Attacker 
I —  Defender 
GamelD 


amelD 


Notation 
Description 
Equilibrium  Typ 


PayoffID 

“GamelD 

Defender 

A1D1 

A1D2 

A1D3 

A2D1 

A2D2 

A2D3 

A3D1 

A3D2 


Appendix  D:  Experiment  Software  Displays 
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Subject  Data  Form 

Please  Complete  The  Information  Below  Then  Click  Continue 


Subject  Number 


40 


Your  name  is  only  used  for  identification.  It  will 
not  be  used  for  data  analysis  or  released. 

Last  Name  j 

First  Name 


Select  'Yes'  for  IW  Experience  ONLY  if  IW  Experience 

you  have  served  in  an  Information 
Security  position  or  have  taken  an  IW 
course. 


O  Yes 
®  No 


Select  'Yes'  for  Game  Theory 
Experience  ONLY  if  you  have  worked 
with  Game  Theory  Modeling  or  similar 
stochastic  models  in  an  Economics  or 
other  Social  Science  course.  Game 
Theory  experience  does  not  denote 
proficiency  playing  games. 


Game  Theory  Experience 

O  Yes 
®  No 


i 


Continue 


Appendix  E:  Experiment  Software  Source  Code 
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Option  Compare  Database 
Option  Explicit 

Private  Sub  Continue_Click ( ) 

Dim  FindSubject  As  QueryDef 

Dim  SubjectRecord  As  Recordset,  ErrorRecord  As  Recordset 
Dim  Query  As  String 

Dim  Subject  As  Integer,  Counter  As  Integer 
On  Error  GoTo  ErrorHandler 
Begin : 

If  IsNull (SubjectNumber)  Then 

MsgBox  "Please  Select  Your  Subject  Number" 

Else 

Subject  =  SubjectNumber 

Query  =  "SELECT  *  FROM  Subjects  WHERE  SubjectID  ="  &  Subject 

Set  FindSubject  =  CurrentDb . CreateQueryDef ( "FindSubj ect "  &  Subject, 

Query) 

Set  SubjectRecord  =  FindSubj ect . OpenRecordset 
Sub j  ectRecord . MoveFirst 

DefenderBox  =  Sub j ectRecord ( "Defender " ) 

Subj  ectRecord . Edit 

Sub j  ectRecord ( " IWExper ience " )  =  IWExperience 
Subj  ectRecord ( "GameExperience" )  =  GameExper ience 
Subj  ectRecord { "LastName" )  =  LastNameBox 
Subj  ectRecord ( " FirstName " )  =  FirstNameBox 

Subj  ectRecord . Update 

CurrentDb . QueryDef s . Delete  "FindSubject"  &  Subject 
CurrentDb . QueryDef s . Refresh 
DoCmd . OpenForm  "GameForm" 

If  DefenderBox  =  True  Then 

DoCmd . OpenForm  "Def enderScenario" 

Else 

DoCmd . OpenForm  "AttackerScenario" 

End  If 

DoCmd. Close  acForm,  " Subj ect Identification" 

End  If 
GoTo  Out 

ErrorHandler : 

Set  ErrorRecord  =  CurrentDb. OpenRecordset ( "Errors" ,  DB_OPEN_DYNASET) 

With  ErrorRecord 
. AddNew 

! BlownUp Count  =  -1  ’  Indicates  that  Error  Occurred  on  Subject  ID  Form 
lErrorDesc  =  Err . Description 
'ErrorNumber  =  Err. Number 
.Update 
End  With 

For  Counter  =  1  To  1000 
Next  Counter 
Resume  Begin 


Out  : 

End  Sub 
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Private  Sub  FeaturesHelpButton_Click ( ) 

If  Forms ! GameForm ! Def enderBox  =  True  Then 
DoCmd . OpenForm  "Def endToolsHelp" 

Else 

DoCmd . OpenForm  " At tackTool sHelp " 

End  If 

End  Sub 

Private  Sub  Form__Open  (Cancel  As  Integer) 

Dim  Payoff  As  Integer 
Dim  i  As  Integer 
Dim  Subject  As  Integer 
Dim  Match  As  Integer 

Dim  Game  As  Integer,  BlownUp  As  Integer 

Dim  Defender  As  Boolean,  TableExists  As  Boolean 

Dim  MovelSum  As  Single,  Move2Sum  As  Single,  Move3Sum  As  Single 

Dim  Query  As  String 

Dim  Payoff Record,  MatchRecord,  SuccessRecord,  TurnRecord,  HistoryRecord 
As  Recordset 

Dim  ErrorRecord  As  Recordset 

Dim  FindPayoff,  FindMatch,  FindSuccess  As  QueryDef 
Dim  MatchTable  As  TableDef 
Dim  MatchField  As  Field 

On  Error  GoTo  Common_Error 
BlownUp  =  0 

Begin : 

Defender  =  Forms ! Subj ect Identification ! Def enderBox 
Subject  =  Forms ! Subj ect Identification ! Subj ectNumber 
Forms ! GameForm! Def enderBox  =  Defender 
Forms ! GameForm! Subj ectBox  =  Subject 
TurnBox  =  1 

If  Defender  =  True  Then 

MovelLabel . Caption  =  "Social  Defense" 

Move2Label . Caption  =  "Client  Defense" 

Move3Label . Caption  =  "Network  Defense" 

'Set  text  color  to  Blue 
MovelLabel . ForeColor  =  16711680 
Move2Label . ForeColor  =  16711680 
Move3Label . ForeColor  =  16711680 

Query  =  "SELECT  *  FROM  Matches  WHERE  Defender  ="  &  Subject 

DmoveBox. Visible  =  True 

DmoveBox . Enabled  =  True 

DmoveBox. TabStop  =  True 

Def endHistory . Visible  =  True 

Def endHistory. Enabled  =  True 

Else 

MovelLabel . Caption  =  "Social  Attack" 

Move2Label . Caption  =  "Client  Attack" 

Move3Label . Caption  =  "Network  Attack" 
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'Set  text  color  to  Red 
MovelLabel . ForeColor  =  255 
Move2Label . ForeColor  =  255 
Move3Label . ForeColor  =  255 

Query  =  "SELECT  *  FROM  Matches  WHERE  Attacker  ="  &  Subject 
AMoveBox. Visible  =  True 
AMoveBox . Enabled  =  True 
AMoveBox. TabStop  =  True 
AttackHistory. Visible  =  True 
AttackHistory .Enabled  -  True 
End  If 

Set  FindMatch  =  CurrentDb . CreateQueryDef ( "FindMatch"  &  Subject,  Query) 

Set  MatchRecord  =  FindMatch . OpenRecordset 

MatchRecord . MoveFirst 

Game  =  MatchRecord ( "GamelD" ) 

Match  =  MatchRecord ( "MatchlD" ) 

GameBox  =  Game 
MatchBox  =  Match 

CurrentDb. QueryDefs. Delete  "FindMatch"  &  Subject 
CurrentDb . QueryDefs . Refresh 

Query  =  "SELECT  *  FROM  Payoffs  WHERE  GamelD  ="  &  Game 

Set  FindPayoff  =  CurrentDb . CreateQueryDef ( "FindPayoff "  &  Subject,  Query) 
Set  PayoffRecord  =  FindPayoff . OpenRecordset 
Payof f Record. FindFirst  "[Defender]  =  "  &  Defender 
AlDIPayof f  =  Str$ (PayoffRecord ("A1D1") ) 

AlD2Payof f  =  Str$ (Payof f Record ( "A1D2 ") ) 

AlD3Payof f  =  Str$ (Payof f Record ( "A1D3 ") ) 

A2DlPayof f  =  Str$ (Payof f Record ( "A2D1 ") ) 

A2D2Payof f  =  Str$ (Payof f Record ( "A2D2 ") ) 

A2D3 Payof f  =  Str$ ( Payof f Record ( "A2D3 ") ) 

A3DlPayof f  =  Str$ (PayoffRecord ( "A3D1" ) ) 

A3D2Payof f  =  Str$ ( Payof f Record ( "A3D2 ") ) 

A3D3Payof f  =  Str$ ( Payof f Record ( "A3D3 ") ) 

CurrentDb . QueryDefs . Delete  "FindPayoff"  &  Subject 
CurrentDb . QueryDefs . Ref resh 

Query  =  "SELECT  *  FROM  Success  WHERE  GamelD  ="  &  Game 

Set  FindSuccess  =  CurrentDb . CreateQueryDef (" FindSuccess "  &  Subject,  Query) 
Set  SuccessRecord  =  FindSuccess . OpenRecordset 
SuccessRecord.  FindFirst  "[Defender]  =  "  Sc  Defender 
AlDlSuccess  =  Str$ (SuccessRecord ("A1D1") ) 

AlD2Success  =  Str$ (SuccessRecord ( "A1D2 ") ) 

AlD3Success  =  Str$ (SuccessRecord ( "A1D3 ") ) 

A2DlSuccess  =  Str$ (SuccessRecord ( "A2D1 ") ) 

A2D2Success  =  Str$ (SuccessRecord ( "A2D2 ") ) 

A2D3Success  =  Str$ (SuccessRecord { "A2D3 ") ) 

A3DlSuccess  =  Str$ (SuccessRecord ( "A3D1 ") ) 

A3D2Success  =  Str$ ( SuccessRecord ( "A3D2 ") ) 

A3D3Success  =  Str$ (SuccessRecord ( "A3D3 ") ) 

If  Defender  =  True  Then 

Move 1 Sum  =  SuccessRecord ( "A1D1 " )  +  SuccessRecord ( "A2D1 " )  + 

SuccessRecord ( "A3D1" ) 

Move 2 Sum  =  SuccessRecord ( "A1D2 " )  +  SuccessRecord ( "A2D2 " )  + 

SuccessRecord ( "A3D2 " ) 

Move 3 Sum  =  SuccessRecord ( "A1D3 " )  +  SuccessRecord ( "A2D3 " )  + 

SuccessRecord ( "A3D3 " ) 

Else 
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MovelSum  =  SuccessRecord ( "A1D1 " )  +  SuccessRecord ( "A1D2 " )  + 
SuccessRecord ( "A1D3 " ) 

Move2Sum  =  SuccessRecord { "A2D1" )  +  SuccessRecord ( "A2D2 " )  + 
SuccessRecord ( " A2D3 " ) 

Move3Sum  =  SuccessRecord ( "A3D1 " )  +  SuccessRecord ( "A3D2 " )  + 
SuccessRecord ( "A3D3 " ) 

End  If 

CurrentDb.QueryDef s .Delete  "FindSuccess"  &  Subject 
CurrentDb . QueryDef  s . Refresh 
If  MovelSum  >=  2  Then 

MovelSuccess  =  "Better  than  60%" 

Elself  MovelSum  >=  1.5  Then 
MovelSuccess  =  "40%-60%" 

Elself  MovelSum  >=  1  Then 

MovelSuccess  =  "30%-40%" 

Else 

MovelSuccess  =  "Less  than  30%" 

End  If 

If  Move2Sum  >=  2  Then 

Move2Success  =  "Better  than  60%" 

Elself  Move2Sum  >=  1.5  Then 
Move2Success  =  "40%-60%" 

Elself  Move2Sum  >=  1  Then 

Move2Success  '=  "30%-40%" 

Else 

Move2Success  =  "Less  than  30%" 

End  If 

If  Move3Sum  >=  2  Then 

Move3Success  =  "Better  than  60%" 

Elself  Move3Sum  >=  1.5  Then 
Move3Success  =  "40%-60%" 

Elself  Move3Sum  >=  1  Then 

Move3Success  =  "30%-40%" 

Else 

Move3Success  =  "Less  than  30% " 

End  If 

'Set  up  match  payoff  table  for  defender  -  attacker  will  simply  link  to  it 
If  Defender  =  True  Then 

'Check  if  Match  Table  already  exists 
TableExists  =  False 

For  Each  MatchTable  In  CurrentDb . TableDefs 

If  MatchTable .Name  =  "Match"  &  Match  Then 
TableExists  =  True 
End  If 

Next 

If  TableExists  =  False  Then 

Set  MatchTable  =  CurrentDb . CreateTableDef ( "Match"  &  Match) 

Set  MatchField  =  MatchTable . CreateField ( "Turn" ) 

MatchField . Type  =  DB_INTEGER 
MatchTable . Fields .Append  MatchField 

Set  MatchField  =  MatchTable . CreateField ( "SuccessNumber" ) 
MatchField. Type  =  DB_S INGLE 
MatchTable .Fields . Append  MatchField 

Set  MatchField  =  MatchTable . CreateField ( "DefenderMoved" ) 
MatchField. Type  «  DB_BOOLEAN 
MatchField. DefaultValue  =  False 

95 


MatchTable . Fields .Append  MatchField 

Set  MatchField  =  MatchTable . CreateField ( "Def enseSuccess n ) 

MatchField. Type  =  DB_BOOLEAN 

MatchField. DefaultValue  =  False 

MatchTable . Fields .Append  MatchField 

Set  MatchField  -  MatchTable . CreateField ( "AMove" ) 

MatchField. Type  =  DB_TEXT 

MatchField. AllowZeroLength  =  True 

MatchTable . Fields .Append  MatchField 

Set  MatchField  =  MatchTable . CreateField ( "DMove " ) 

MatchField. Type  =  DB_TEXT 
MatchField. AllowZeroLength  =  True 
MatchTable . Fields .Append  MatchField 
CurrentDb.TableDef s .Append  MatchTable 
CurrentDb . TableDef s . Refresh 

Set  TurnRecord  =  CurrentDb . OpenRecordset ( "Match"  &  Match) 

Set  HistoryRecord  =  CurrentDb . OpenRecordset ( "History" ) 

For  i  =  1  To  4  0 

'Now  create  turn  Entries 
TurnRecord . AddNew 
TurnRecord ( " Turn " )  =  i 
TurnRecord ( "AMove " )  =  " " 

TurnRecord ( "DMove" )  =  "" 

TurnRecord . Update 
'Setup  History  Table  Records 
HistoryRecord .AddNew 
HistoryRecord ( "MatchID" )  =  Match 
HistoryRecord ( "Turn" )  =  i 

HistoryRecord . Update 

Next 
End  If 
End  If 

GoTo  Out  '  skip  error  handling 

'Labels  Section 

Common^Error : 

If  BlownUp  >40  Then 
Resume  Fatal 

Elself  Err. Number  -  3012  Then 

If  StrComp (Query,  "SELECT  *  FROM  Matches  WHERE  Defender  ="  & 

=  0  Then 

Current Db.QueryDefs .Delete  "FindMatch"  &  Subject 
CurrentDb . QueryDef s . Refresh 

Elself  StrComp (Query,  "SELECT  *  FROM  Matches  WHERE  Attacker 
Subject)  =  0  Then 

CurrentDb.QueryDef s .Delete  "FindMatch"  &  Subject 
CurrentDb . QueryDef s . Refresh 

Elself  StrComp (Query,  "SELECT  *  FROM  Payoffs  WHERE  GamelD  =" 

=  0  Then 

CurrentDb.QueryDef s .Delete  "FindPayoff "  &  Subject 
CurrentDb . QueryDef s . Refresh 

Elself  StrComp (Query,  "SELECT  *  FROM  Success  WHERE  GamelD  =" 

CurrentDb . QueryDef s . Delete  " FindSuccess "  &  Sub j  ect 
CurrentDb . QueryDef s . Refresh 
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Subj  ect) 


=  "  Sc 


Sc  Game ) 


Sc  Game ) 


0  Then 


End  If 

Resume  Begin 


Else 

BlownUp  =  BlownUp  +  1 

Set  ErrorRecord  =  CurrentDb . OpenRecordset ( "Errors" ,  DB_OPEN_DYNASET) 
With  ErrorRecord 
.AddNew 

! BlownUpCount  =  BlownUp 
!ErrorDesc  =  Err . Description 
JErrorNumber  =  Err. Number 
.Update 
End  With 
Resume  Begin 
End  If 


Fatal : 

MsgBox  "An  Error  has  Occurred  in  Form_GameForm: Class  Module  Load__Form. 
Notify  Experimenter" 

GoTo  Out 


Out : 

End  Sub 

Private  Sub  GameHelpButton_Click ( ) 

If  Forms ! Game Form! DefenderBox  =  True  Then 
DoCmd . OpenForm  "Def enderHelp" 

Else 

DoCmd . OpenForm  " AttackerHelp" 

End  If 

End  Sub 

Public  Sub  MakeMove_Click ( ) 

Dim  MatchReady  As  Boolean 
Dim  Defender  As  Boolean 

Dim  AttackerMove  As  String,  DefenderMove  As  String,  MoveSt'ring  As  String 
Dim  InitPayoff  As  Integer,  i  As  Integer,  MsgResponse  As  Integer,  BlownUp 
As  Integer,  WaitCount  As  Integer 

Dim  Turn  As  Integer,  Match  As  Integer,  Game  As  Integer 

Dim  AttackerPayof f  As  Single,  Def enderPayof f  As  Single,  SuccessProb  As 
Single 

Dim  RandomNumber  As  Single 

Dim  TurnRecord  As  Recordset,  ErrorRecord  As  Recordset 
Dim  MatchTable  As  TableDef 

On  Error  GoTo  ErrorHandler 

BlownUp  =  0 

Defender  =  Forms ! GameForm ! Def enderBox 
Turn  =  Forms ! GameForm ! TurnBox 
Match  =  Forms ! GameForm ! MatchBox 
Game  =  Forms ! GameForm ! GameBox 
If  Defender  =  True  Then 
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Def enderMove : 

If  IsNull ( DmoveBox )  Then 
GoTo  No_Move 
End  If 

Def enderMove  =  ConvertMove (DmoveBox,  True) 

Set  TurnRecord  =  CurrentDb . OpenRecordset ( "Match"  &  Match, 
DB_OPEN_DYNASET) 

TurnRecord. FindFirst  "[Turn]  =  "  &  Turn 
WaitCount  =  0 

While  TurnRecord. EditMode  =  dbEdit InProgress 
If  WaitCount  >  35000  Then 

MsgResponse  =  MsgBoxC'Move  processing  may  be  taking  too  long. 
Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  =  0 

Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 

Wend 

TurnRecord . Edit 

TurnRecord ( "DMove" )  =  Def enderMove 
TurnRecord . Update 
DoCmd. Hourglass  True 
WaitCount  =  0 

While  TurnRecord ( "AMove" )  =  "" 

If  WaitCount  >  35000  Then 

MsgResponse  =  MsgBox("Move  processing  may  be  taking  too  long. 
Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  =  0 

Else 

GoTo  Out 
End  If 
End  If 

WaitCount’  =  WaitCount  +  1 

Wend 

AttackerMove  =  TurnRecord ( "AMove" ) 

DoCmd . Hourglass  False 
'Get  Initial  Payoff 

MoveString  =  AttackerMove  &  DefenderMove 
InitPayoff  =  FindPayoff (MoveString) 

SuccessProb  =  FindSuccess (MoveString) 

WaitCount  =  0 

While  TurnRecord. EditMode  =  dbEditlnProgress 
If  WaitCount  >  35000  Then 

MsgResponse  =  MsgBoxC'Move  processing  may  be  taking  too  long. 
Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  -  0 

Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 
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Wend 

TurnRecord . Edit 
Randomize 

TurnRecord ( "SuccessNumber " )  =  Rnd ( ) 

If  TurnRecord ( "SuccessNumber" )  <  SuccessProb  Then 
Def enderPayof f  =  0 

TurnRecord ( "DefenseSuccess" )  =  True 
MoveSuccessBox  =  "Successful!" 

Else 

Def enderPayof f  =  InitPayoff 
TurnRecord ( "Def enseSuccess" )  =  False 
MoveSuccessBox  =  "Unsuccessful!" 

End  If 

TurnRecord ( "Def enderMoved" )  =  True 
TurnRecord . Update 
TurnRecord . Close 
LastPayof f Box  =  PayoffBox 
PayoffBox  =  Def enderPayof f 

Call  UpdateHistory (Def enderPayof f ,  Def enderMove ,  Match,  Turn) 

Beep 

Else 

AttackerMove : 

If  IsNull (AMoveBox)  Then 
GoTo  No_Move 
End  If 

AttackerMove  =  ConvertMove (AMoveBox,  False) 

MatchReady  =  False 

'Ensure  that  the  Match  Table  exists 
WaitCount  =  0 
While  MatchReady  =  False 

For  Each  MatchTable  In  CurrentDb . TableDef s 

If  MatchTable .Name  =  "Match"  &  Match  Then 
MatchReady  =  True 
End  If 

Next 

If  WaitCount  >  1000  Then 

MsgResponse  =  MsgBox ( "Match  initialization  may  be  taking  too 
long.  Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  =  0 

Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 

Wend 

Set  TurnRecord  =  CurrentDb . OpenRecordset ( "Match"  &  Match, 
DB_OPEN_DYNASET) 

TurnRecord . FindFirst  "[Turn]  =  "  &  Turn 
WaitCount  =  0 

While  TurnRecord . EditMode  =  dbEditlnProgress 
If  WaitCount  >  35000  Then 

MsgResponse  =  MsgBox ("Move  processing  may  be  taking  too  long. 
Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  =  vbYes  Then 
WaitCount  =  0 
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Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 

Wend 

TurnRecord . Edit 

TurnRecord ( "AMove" )  =  AttackerMove 
TurnRecord . Update 
DoCmd. Hourglass  True 
WaitCount  =  0 

While  (TurnRecord  ("DMove")  =  "  11 )  Or  (TurnRecord  (  "Def enderMoved"  )  =  False) 
If  WaitCount  >  35000  Then 

MsgResponse  =  MsgBox ( "Move  processing  may  be  taking  too  long. 
Notify  the  Experimenter.  Continue  Waiting?",  vbYesNo) 

If  MsgResponse  -  vbYes  Then 
WaitCount  =  0 

Else 

GoTo  Out 
End  If 
End  If 

WaitCount  =  WaitCount  +  1 

Wend 

DefenderMove  =  TurnRecord ( "DMove" ) 

DoCmd . Hourglass  False 
'Get  Initial  Payoff 

MoveString  =  AttackerMove  &  DefenderMove 
InitPayoff  =  FindPayoff (MoveString) 

SuccessProb  =  FindSuccess (MoveString) 

If  TurnRecord ( "Def enseSuccess" )  =  False  Then 
AttackerPayof f  =  InitPayoff 
MoveSuccessBox  =  "Successful!" 

Else 

AttackerPayof f  =  0 
MoveSuccessBox  =  "Unsuccessful!" 

End  If 

Last Payoff Box  =  Payoff Box 
PayoffBox  =  AttackerPayof f 

Call  UpdateHistory (AttackerPayof f,  AttackerMove,  Match,  Turn) 

Beep 
End  If 

'Check  if  40  turns  completed 
If  Turn  =  40  Then 

MsgBox  "You  Have  Completed  The  Experiment.  Please  Wait  Quietly  Until 
Released.  Thanks  for  Your  Participation" 

GoTo  Out 
End  If 

'Normal  End  of  Turn  Processing 
Turn  =  Turn  +  1 
Forms ! GameForm ! TurnBox  =  Turn 
GoTo  Out 

'LABELS  SECTION 

No  Move : 
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MsgBox  "Please  Select  a  Move!" 

If  Defender  =  True  Then 
DmoveBox . SetFocus 

Else 

AMoveBox . SetFocus 
End  If 
GoTo  Out 

ErrorHandler : 

BlownUp  =  BlownUp  +  1 

Set  ErrorRecord  =  CurrentDb . OpenRecordset ( "Errors" 
With  ErrorRecord 
. AddNew 

! BlownUpCount  =  BlownUp 
!ErrorDesc  =  Err . Description 
!ErrorNumber  =  Err. Number 
.Update 
End  With 

If  Defender  =  True  Then 
Resume  DefenderMove 

Else 

Resume  AttackerMove 
End  If 


Abort : 

MsgBox  "Experiment  Terminated!" 

DoCmd . Hourglass  False 

DoCmd. Close  acForm,  "GameForm" 


Out  : 

End  Sub 


Public  Function  FindPayoff (Move  As  String)  As  Integer 


If  Move  -  " A1D1 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
Elself  Move  =  M 
FindPayoff 
Elself  Move  =  " 
FindPayoff 
End  If 


"  Then 

=  Int (Forms ! GameForm ! A1D1 Payoff ) 
A1D2 "  Then 

=  Int (Forms ! GameForm! A1D2 Payoff ) 
A1D3 "  Then 

-  Int (Forms ! GameForm !A1D3 Payoff ) 
A2D1"  Then 

=  Int (Forms ! GameForm ! A2D1 Payoff ) 
A2D2 "  Then 

=  Int (Forms ! GameForm !A2D2 Payoff ) 
A2D3 "  Then 

=  Int (Forms ! GameForm !A2D3 Payoff ) 
A3D1 "  Then 

=  Int (Forms ! GameForm! A3 D1 Payoff ) 
A3D2 "  Then 

=  Int (Forms ! GameForm! A3D2 Payoff ) 
A3D3 "  Then 

=  Int (Forms ! GameForm !A3D3 Payoff ) 


End  Function 


Public  Function  FindSuccess (Move  As  String)  As  Single 

If  Move  =  "A1D1 "  Then 

FindSuccess  =  Forms IGameForm! AlDlSuccess 
Elself  Move  =  MA1D2 "  Then 

FindSuccess  =  Forms ! GameForm! AlD2Success 
Elself  Move  =  "A1D3"  Then 

FindSuccess  =  Forms ! GameForm !AlD3Success 
Elself  Move  =  "A2D1 "  Then 

FindSuccess  =  Forms ! GameForm !A2DlSuccess 
Elself  Move  =  "A2D2 "  Then 

FindSuccess  =  Forms IGameForm! A2D2Success 
Elself  Move  =  "A2D3"  Then 

FindSuccess  =  Forms IGameForm! A2D3 Success 
Elself  Move  =  "A3D1"  Then 

FindSuccess  =  Forms IGameForm! A3DlSuccess 
Elself  Move  =  "A3D2"  Then 

FindSuccess  =  Forms ! GameForm! A3D2Success 
Elself  Move  =  "A3D3"  Then 

FindSuccess  -  Forms ! GameForm !A3D3Success 
End  If 


End  Function 

Public  Sub  UpdateHistory (Payoff  As  Single,  Move  As  String,  Match  As  Integer, 
Turn  As  Integer) 


Dim  HistoryQuery  As  QueryDef 
Dim  HistoryRecord  As  Recordset, 
Dim  Query  As  String 
Dim  BlownUp  As  Integer 

On  Error  GoTo  Error_Handler 
BlownUp  =  0 

Begin : 

If  Move  =  " A1 "  Then 

Move  =  "Social  Attack" 

Forms ! GameForm ! MovelTurns  = 
Forms ! GameForm ! Move 1 Payoffs 
Forms ! GameForm ! MovelAverage 
Forms ! GameForm ! MovelTurns 

Elself  Move  =  "A2"  Then 

Move  =  "Client  Attack" 

Forms ! GameForm !Move2 Turns  = 
Forms ! GameForm !Move2 Payoffs 
Forms ! GameForm ! Move2 Average 
Forms ! GameForm ! Move2Turns 
Elself  Move  =  "A3"  Then 

Move  =  "Network  Attack" 
Forms ! GameForm ! Move3Turns  = 
Forms ! GameForm !Move3 Payoffs 
Forms ! GameForm ! Move3Average 
Forms ! GameForm ! Move3Turns 
Elself  Move  =  "Dl"  Then 


ErrorRecord  As  Recordset 


Forms ! GameForm ! MovelTurns  +  1 
=  Forms ! GameForm ! MovelPayof f s  +  Payoff 
=  Forms ! GameForm ! MovelPayof fs  / 


Forms ! GameForm! Move2 Turns  +  1 
=  Forms 'GameForm !Move2 Payoff s  +  Payoff 
=  Forms IGameForm !Move2 Payoff s  / 


Forms IGameForm !Move3Turns  +  1 
=  Forms IGameForm !Move3 Payoff s  +  Payoff 
=  Forms 'GameForm !Move3 Payoff s  / 
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Move  =  "Social  Defense" 

Forms ! GameForm ! MovelTurns  =  Forms ! GameForm ! Move ITurns  +  1 

Forms ! GameForm ! Move 1 Payoff s  =  Forms ! GameForm I  Move 1 Payoff s  +  Payoff 

Forms ! GameForm IMovelAverage  =  Forms ! GameForm ! Move 1 Payoff s  / 

Forms ! GameForm ! MovelTurns 
Elself  Move  =  "D2"  Then 

Move  =  "Client  Defense" 

Forms 'GameForm !Move2Turns  =  Forms ! GameForm! Move2Turns  +  1 

Forms ! GameForm !Move2 Payoff s  =  Forms ! GameForm !Move2 Payoff s  +  Payoff 

Forms ! GameForm !Move2 Average  =  Forms ! GameForm !Move2 Payoffs  / 

Forms ! GameForm ! Move2Turns 
Elself  Move  =  "D3"  Then 

Move  =  "Network  Defense" 

Forms ! GameForm !Move3 Turns  =  Forms ! GameForm! Move3Turns  +  1 

Forms ! GameForm ! Move3 Payoff s  =  Forms ! GameForm 1 Move3 Payoff s  +  Payoff 

Forms  1 GameForm !Move3 Average  =  Forms ! GameForm !Move3 Payoff s  / 

Forms ! GameForm ! Move3Turns 
End  If 

Query  =  "SELECT  *  FROM  History  WHERE  MatchID  =  "  &  Match 
Set  HistoryQuery  =  CurrentDb . CreateQueryDef ( "FindHistory"  &  SubjectBox, 
Query) 

Set  HistoryRecord  =  HistoryQuery . OpenRecordset 
HistoryRecord . FindFirst  "[Turn]  =  "  &  Turn 
If  DefenderBox  =  True  Then 

While  HistoryRecord. EditMode  =  dbEditlnProgress 
Wend 

HistoryRecord. Edit 

HistoryRecord ( "Def endAction" )  =  Move 
HistoryRecord ( "Def endPayof f " )  =  Payoff 
HistoryRecord . Update 
HistoryRecord . Close 
Def endHi story . Requery 

Else 

While  HistoryRecord . EditMode  =  dbEditlnProgress 
Wend 

HistoryRecord . Edit 

HistoryRecord ( "AttackAction" )  =  Move 
HistoryRecord ( "AttackPayof f " )  =  Payoff 
HistoryRecord .Update 
HistoryRecord. Close 
AttackHistory. Requery 
End  If 

Delete_Query : 

CurrentDb . QueryDefs . Delete  "FindHistory"  &  SubjectBox 
CurrentDb . QueryDefs . Refresh 
GoTo  Out 

Error_Handler : 

If  Err. Number  =  3167  Then 
Resume  De 1 e t e_Que ry 
Elself  Err. Number  =  3012  Then 

CurrentDb . QueryDefs . Delete  " FindHistory"  &  Sub j ectBox 
CurrentDb . QueryDefs . Refresh 
Resume  Begin 

Else 

BlownUp  =  BlownUp  +  1 
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Set  ErrorRecord  =  CurrentDb . OpenRecordset ( "Errors" ,  DB_OPEN_DYNASET) 
With  ErrorRecord 
.AddNew 

•BlownUpCount  =  BlownUp 
lErrorDesc  =  Err . Description 
l ErrorNumber  =  Err. Number 
.Update 
End  With 
Resume  Begin 
End  If 


Out : 

End  Sub 

Public  Function  ConvertMove (Move  As  String,  Defender  As  Boolean)  As  String 
'Converts  Move  from  User’s  Name  to  Al/Dl  Notation 

If  Defender  =  True  Then 

If  Move  =  "Social  Defense”  Then 
ConvertMove  =  ”D1” 

Elself  Move  =  "Client  Defense"  Then 
ConvertMove  =  "D2" 

Else 

ConvertMove  =  "D3" 

End  If 

Else 

If  Move  =  "Social  Attack"  Then 
ConvertMove  =  "Al" 

Elself  Move  =  "Client  Attack"  Then 
ConvertMove  =  "A2" 

Else 

ConvertMove  =  "A3 " 

End  If 
End  If 

End  Function 
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